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ABSTRACT 

The extreme importance of critical infrastructures to modem society is widely recognized. 
These infrastructures are complex, interdependent, and ubiquitous; they are sensitive to 
dismptions that can lead to cascading failures with serious consequences. Protecting the critical 
infrastmctures from terrorism, human generated malevolent attack directed toward maximum 
social disruption, presents an enormous challenge. Recognizing that society cannot afford the 
costs associated with absolute protection, it is necessary to identify the critical locations in these 
infrastmctures. By protecting the critical locations society achieves the greatest benefit for the 
protection investment. This project examines a screening methodology for the identification of 
critical locations in infrastmctures. The framework models the infrastmctures as intercoimected 
digraphs and employs graph theory and reliability theory to identify the vulnerable points. The 
vulnerable points are screened for their susceptibility to a terrorist attack, and a prioritized list 
of critical locations is produced. The prioritization methodology is based on multi-attribute 
utility theory, and involves various disciplines including quantitative risk assessment and 
decision analysis. The methodology is illustrated through the presentation of a portion on the 
analysis conducted on the community of the Massachusetts Institute of Technology. 
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I. Introduction 

Critical Infrastructures provide the very foundation for the standard of living in the 
United States and other Western Democracies. These infrastructures form an over-arching net 
covering the modem way of life. The infrastructures are large, diffuse, heterogeneous, inter¬ 
connected networks, and while critically important, the infrastmctures are difficult to control 
reliably. They include numerous interaction points and local disturbances can cascade very 
quickly. The complexity of these networks leads to difficulty in modeling and control 
methodologies. The importance of these infrastructures has long been recognized. Executive 
Order 13010, July 15, 1996, [Clinton, 1996] stated: 

America’s critical infrastructures underpin every aspect of our lives. 

They are the foundations of our prosperity, enablers of our defense, and 
the vanguard of our future. They empower every element of our society. 

There is no more urgent priority than assuring the security, continuity, 
and availability of our critical infrastructures... 

Two recent events highlight the vulnerability of the critical infrastructures. First, the terrorist 
attacks on September 11, 2001, were conducted through exploitation of the Transportation 
infrastmcture. The great oceans no longer provide sufficient protection; America must defend 
itself against malicious attack. Second, the East Coast blackout of August 14,2003, 
demonstrated the fragility of one particular infrastmcture, the electrical generation and 
distribution networks. Roughly 50 million people across the North Eastern United States and 
Eastern Canada suffered one of North America's worst ever electric power outages. The loss 
of electricity cascaded through several other critical infrastmctures. For example, water was 
lost due to loss of power at the pumping stations, and transportation was hampered due to the 
loss of air and ground traffic control. Terrorist acts have similarities and differences with 
natural and technological disasters, but are distinguished by a malevolent intelligence directed 
toward maximum social dismption. One subset of the potential targets of terrorist acts is the 
nation’s critical infrastmctures [OHS, 2002]. Critical infrastmctures are complex, 
interdependent, and ubiquitous; they are sensitive to dismptions that can lead to cascading 
failures with serious consequences. Complex national infrastmctures have critical nodes or 
choke points that, if attacked, could lead to significant dismption or destmction. [Garrick, 
2004] Conventional assaults with tmck bombs, dynamite, or cable cutting, as well as 




computer generated attacks, could unleash a chain of events in which a service grid, an oil of 
gas pipeline, or an air traffic control system collapses with cascading effect. [Garrick, 2004] 
After September 11th, critical infrastructure protection became a national focus and is 
likely to remain one for the foreseeable future. The federal government has reorganized 
agencies into a Department of Homeland Security, and all levels of government have been 
increasing resources and taking specific measures (such as tightening airline security) for 
infrastructure protection. An excellent overview of the terrorist threat is presented in the 
article Infrastructure Issues for Cities - Countering Terrorist Threat [Gilbert, et al, 2003]. 
The authors identify the importance of the critical infrastructures to the United States’ cities; 
over 80% of the US population lives in and around the cities. [U.S. Census 2000] The 
challenges in protecting United States’ cities from multiple coordinated attacks are addressed. 
A key point presented by the authors is that the infrastructure systems were never intended by 
their designers to resist the consequences of planned malicious destruction. [Gilbert, et al, 
2003] Additional perspectives are available on the state of the terrorist threat (for example 
[Garrick, 2002; Deisler, 2002; and Haimes, 2002]. The National Strategy for the Physical 
Protection of Critical Infrastructures and Key Assets [Bush, 2003] identifies critical 
infrastructures and key assets. Table I.l. 


Critical Infrastructures 

Key Assets 

Agriculture and Food 

National Momunents, Icons 

Water 

Nuclear Power Plants 

Public Health 

Dams 

Emergency Services 

Government Facilities 

Defense Industrial Base 
Telecommunications 

Energy 

Transportation 

Banking and Finance 

Chemicals, Hazardous Materials 

Postal and Shipping 

Commercial Key Assets 


Table I.l Critical Infrastructures and Key Assets 


A systematic approach to the identification of the significant relevant risks from 
terrorism, and the development of effective measures for managing them, has not yet been 
undertaken [OHS, 2002]. Society has limited resources and can ill-afford to use them on 
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measures that have not been demonstrated effective. An example is the recent National 
Research Council report on countering terrorism [NRC, 2002]. This report offers numerous 
recommendations for the reduction of vulnerabilities in transportation systems, information 
technology, energy systems, and other infrastructures. Implementing all of them would 
impose a considerable financial burden on the nation and would ignore the probabilities of 
these vulnerabilities. Furthermore, the costs and risk-reduction potential of proposed coimter- 
terrorism measures have not yet been evaluated systematically. A framework that would allow 
for a rigorous evaluation of the merits of such proposals would be highly desirable. This 
project takes steps toward creating a screening methodology for the identification of critical 
locations. Developing the complete framework requires overcoming significant challenges, 
including the geographic and organizational diffusiveness of infrastructure systems, and the 
importance of multi-organizational responses in disaster prevention, mitigation, and response. 

Protecting a complex and interconnected system of infrastructures at the national level 
creates major technical challenges because of the complexity and diffuse nature of this 
system. Historically, critical infrastructure protection has tended to be addressed on an 
infrastructure-specific basis by individual engineering commxmities (e.g., the electric power 
industry). Traditional safety methods such as risk assessment are enabled by features of the 
analytical context such as the standardization of the technology, the bounded number of event 
triggers of accidents, and the spatial compactness of components. In contrast, societal 
infrastructures are far more idiosyncratic, interconnected across systems, and spread out 
geographically (see, for example, [Haimes, 2002; Kunreuther and Lemer-Lam, 2002; Stewart 
and Bostrom, 2002]). Further, societal infrastructures have overlapping ownership and 
responsibility in private organizations and local, state, and national government. Therefore, 
technical complexity is matched or exceeded by sociopolitical complexity. There are many 
practical and theoretical challenges to developing effective methods for representing and 
planning for infrastructure threats and coordinating actual responses. 

Of particular importance are human actions. For engineering systems, it is the actions 
of the facility operators that are modeled using the work of human error theorists [e.g.. 

Reason, 1990; Strater and Bubb, 1999]. Organizational influences on operator performance 
are still in a state of development. [Pate-Comell, 1990; Davoudian et al, 1994; Reason, 1997; 
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Marcinkowski et al, 2001] The case of infrastructures is very different in that there is not a 
well-defined operator crew that attempts to mitigate the accident but, rather, a number of 
organizations that would participate in preventing, mitigating, and responding to an event 
(e.g., local infrastructure operators, first responders, disaster-recovery agencies). Drabek 
[1985] describes the response to emergencies as “emergent multiorganizational networks” 
because the relationships among overlapping responder organizations emerge during the event 
rather than from prior planning. Inter-organizational preparedness is critical to effective 
response. [Gillespie and Streeter, 1987] It is evident, therefore, that the development of 
sequences of events leading to undesirable end states will require iimovative approaches to the 
“recovery” actions. Building multi-organizational responses into the measurement of critical 
infi'astructure risk, safety, and priority is a theoretical and practical challenge. 

Scenario-based methodologies have been developed to manage the safety of complex 
systems such as space systems (the International Space Station [Futron, 2002] and the Shuttle 
[SAIC, 1995]), waste repositories [Rechard, 1996], nuclear power plants [USNRC, 1990], 
large incinerators [SAIC, 1996], chemical process facilities [CCPS, 1989], municipal water 
distribution systems [Ezell et al, 2000], and other systems [Hokstad et al, 2001; Melchers and 
Feutril, 2001]. It has also been used to identify research needs. [Apostolakis et al, 1995] 

This methodology is known as Probabilistic Risk Assessment (PRA), Quantitative Risk 
Assessment (QRA), or Performance Assessment. This approach has been found useful 
because it: 

1. Provides a common imderstanding of the problem, thus facilitating 
communication among various stakeholder groups. 

2. Reduces the probability of emotional reactions because it provides a framework 
for the evaluation of various risk management proposals. 

3. Offers an integrated approach, thus identifying the needs for contributions from 
diverse disciplines such as the engineering and the social and behavioral 
sciences. 

4. Encourages identification of complex interactions between events/systems. 

To better understand the relevant issues facing the nation as a whole, it is often useful 
to examine a smaller-scale system to uncover insights and issues. This project pushes deeper 
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into the infrastructure protection issue by analyzing the campus of the Massachusetts Institute 
of Technology (MIT), which is a small community embedded within the city of Cambridge, 
Massachusetts. Cambridge is a diverse community, a small city of over 100,000, with 
disaster planning coordinated through its own Local Emergency Planning Committee that 
includes participation from MIT. MIT itself can be considered a small town with 
approximately six thousand residents and an additional fourteen thousand commuters. MIT 
operates a utility plant, data network, cable television station, and phone system, and has its 
own police and medical personnel. This project has the full cooperation on the MIT 
Department of Facilities (DOF), which provided complete information on the infrastructures. 
Completeness of the documentation supporting national infrastructures is uncertain. Some 
estimates list up to ten percent of natural gas distribution lines and up to twenty percent of 
water distribution lines as undocumented. The MIT campus contains a Critical Infrastructure, 
the Central Utilities Plant (CUP). The CUP houses a natural gas fired turbine generator which 
provides for MIT’s electrical, steam, and air conditioning needs. Additionally, the CUP 
contains the electrical distribution system, controlling on-site generation and back-up 
electricity from the local electric utility. The MIT campus also contains a Key Asset, the 
Nuclear Research Reactor. Although the research reactor is not a power plant as defined by 
the National Strategy, it is an excellent representation of Key Asset. 

This project examined three critical infrastructures, electric power, water (domestic 
and fire protection), and natural gas, and the interactions between them. The focus was to 
develop a methodology for the identification of critical locations in infrastructures. A critical 
location is defined as a point against which a successfully attacked could lead to significant 
consequences. The more serve the consequences, the more critical the location. On a 
national scale many potentially critical locations, such as the George Washington Bridge, in 
New York City, or the Hoover Dam, in Boulder City, Nevada, may be easily identified. Other 
locations may only be revealed through analysis of the infrastructures. For example, a 
Financial Institution may have a main communication line for the processing of monetary 
transactions and a “completely” independent, back-up communication line, both of which run 
underground and connect to the telecommunications network, under the street, at separate 
points. In the event of failure of the main communication line, data is automatically routed 



over the back-up line with minimal disruption. On initial review the data transmission system 
appears secure from a single point failure affecting either data transmission line. What if both 
telecommunication lines pass through the same physical conduit between the building and the 
telecommunications network? Or both lines are, at some point, accessible from the same 
manhole? In that case the data transmission system is subject to a single point failure in the 
form of a physical attack on the transmission conduit. 

A single point failure is not limited to an individual infrastructure, but may affect 
multiple infrastractures. For example, in portions of Washington, DC, water and electrical 
distribution systems occupy the same service tunnels. The concept of service tunnels and 
man-way access points is appealing to many people in urban design and city planning. By 
burying the infrastructures, with limited access points, they are secure from common vandals 
and moderate environmental disruptions, and are “out-of-sight” so they don’t distract from 
beautification. Putting multiple infrastructures in common service tunnels creates the 
potential for the unintended development of critical locations. 

This work discusses a methodology for the identification of individual critical 
locations. Also, the methodology addresses combinations of locations, which when attacked 
through simultaneous or sequential events could lead to significant consequences. The critical 
locations, and location combinations, and there ranking according to potential impact will be 
the basis of risk informed decision making. 






II. Background 

II.l Quantitative Risk Assessment 

Quantitative Risk Assessment (QRA) is a proven, well established, and systematic 
process for examining engineered systems to produce an understanding of the associated 
risks. QRA is typically used to examine systems whose operation is based on design 
requirements, and defined human and computer controlled actions. The quantitative process 
combines the probability of an event with the anticipated consequences of the event to 
produce an overall risk picture of the system. QRA is helpful in recognizing the components 
and failure modes which contribute the greatest to risk. In general terms, QRA asks the 
following questions [Kaplan and Garrick, 1981]: 

• What can go wrong? 

• What are the consequences? 

• How likely is it? 

For a given system, QRA proceeds as follows: 

1. A set of undesirable end states is defined, e.g., in terms of individual or 
societal risk. 

2. For each end state, a set of disturbances to normal operation is defined 
which, if uncontained or unmitigated, can lead to the end state. These are 
called initiating events (lEs). 

3. Event and fault trees are employed to identify sequences of events that 
start with an IE and end at an end state. Thus, accident scenarios are 
generated. 

4. The probabilities of these scenarios are evaluated using all available 
evidence, primarily past experience and expert judgment. 

5. Results are used for “insight” to educate participants, help define 
priorities, reveal interdependencies, and show leverage points. QRA is a 
planning-as-leaming exercise, not simply an analysis tool. 


The definition of end states and lEs is a critical part of risk assessment because it may 
lead to an incomplete analysis. For well-understood systems such as nuclear power plants, 
standardized lists of end states and lEs have been developed. For infrastructures, these must 






be identified using a systematic approach. The MIT Department of Facilities has developed a 
methodology using multiattribute decision analysis for prioritizing maintenance work. 
[Karydas and Gifun, 2002] This work identifies an initial list of end states applicable to MIT 
as follows: Impact on Health, Safety, and the Environment; Economic Impact (physical 
property, intellectual property; interruption of academic activities and operations); and Impact 
on Public Image. These end states will serve as the starting point of an iterative process to 
identify end states appropriate to terrorist threats. 

The next step is to identify the lEs for each end state. A systematic method for doing 
this is to employ a Master Logic Diagram (MLD). [USNRC, 1982; NASA, 2002] The MLD 
is a fault-tree (top-down) type logic diagram that helps to identify the lEs. Once the lEs have 
been identified, standard event/fault trees can be employed to develop sequences of events 
that may lead from each IE to each end state. These sequences include hardware failures, 
natural phenomena, and human errors (e.g., during recovery actions). 

The evaluation of the probabilities of the scenarios will be another major challenge. 
QRAs utilize the Bayesian (degree-of-belief) interpretation of probability that allows the use 
of all evidence, i.e., statistical, experiential, and expert judgment. [Apostolakis, 1990] While 
statistical evidence would be the most desirable basis for this evaluation, in reality the project 
will have to rely on expert judgment. Methods for the structured elicitation and utilization of 
expert judgment have been developed and applied in major risk studies, [e.g., Keeney and von 
Winterfeldt, 1991; Cooke, 1991; Draper, 1995; Budnitz et al, 1995] 

It is recognized that QRA models rare events, some which have never happened and 
others with very infrequent occurrences. Additionally, human behavior and the severity of 
some events may be challenging to understand. These factors leave the risk assessment with 
some recognized degree of uncertainty. QRA highlights these issues and incorporates a 
systematic process for treating them. The importance of the uncertainties, and the degree to 
which they are assessed, varies based on the decision requirements. 

The successful application of Quantitative Risk Assessment provides an understanding 
of the risks associated with the system and an expression of the uncertainties involved, which 
together produce a relative risk ranking. QRA forms the basis for risk-informed decision 
making. 
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II.2 Decision Analysis 

Decision Analysis (DA) is a formal process, Figure II. 1, designed to structure complex 
problems for analysis, deal with tradeoffs between multiple objectives, identify and quantify 
sources of uncertainty, and incorporate subjective judgments. DA is a methodology to assist 


Decision Analysis 



Figure II. 1 Decision Analysis [Loerch, 1996] 

decision makers in achieving appropriate decisions. Decision Analysis is applied to the case 
of identifying the critical locations in infrastructures to assist in establishing the prioritization 
methodology. The prioritization methodology provides a guideline for rank ordering events 
in many situations. While the methodology is a general approach, which may be applied in 
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numerous situations, the analysis is specific to each decision case. The methodology is 
portable, but the analysis must be repeated for each specific application. 

The prioritization methodology is a structured approach that determines the most 
appropriate prioritization based on a performance index (PI) calculated for each item. [Weil 
and Apostolakis, 2001] The priority of each item is ranked according to the PI. The PI is the 
sum of the weights of individual performance measures (PM) multiplied by the disutilities of 
each item for that particular PM. The PMs are measures of the community’s objectives. 

i 

where 

PIj is the performance index for item j 

Wi is the weight of the performance measure i 

djj is the disutility of performance measure i for item j 

Kpm is the number of performance measures 

In this application, PIa > PIb when the decision maker assess alternative A to cause more 
disutility than alternative B. The performance measures are designed to be independent, 
meaning the preference for the consequences depend only on the individual levels of the 
separate PMs, not on the way they are combined. PMs are independent to prevent a double 
count. Pairs of PMs are Preference Independent of other PMs if preferences for the levels of 
these two PMs do not depend on the value of any other PMs. Also, a PM is Utility 
Independent of other PMs of preferences for risky situations involving probabilities of the 
different levels of the PM do not depend on the fixed level of any other PM. Performance 
measure independence leads to use of the above Additive Value Function for Disutility. 
[Loerch, 1996] In cases where the PMs are not independent the Multiplicative Value 
Function must be employed. In the analysis of critical infrastructures the PMs have been 
designed to be independent. 

Determination of the performance index follows a six step procedure. [Weil and 
Apostolakis, 2001] 

1. Structure the obj ectives 

2. Determine the appropriate performance measures 



3. Weighting objectives and performance measures 

4. Assessing disutility functions of performance measures 

5. Performing consistency checks 

6. Validating the results 

Structuring the objectives is necessary to identify the fundamental objectives, those 
fundamental to the decision maker in analyzing the environment. Structuring also identifies 
the means objectives, those not specifically important to the decision maker but which support 
the fundamental objectives. [Clemen, 1991] A value tree, a hierarchical relationship, is 
employed to structure the objectives and applicable performance measures. The value tree for 
the efficient prioritization of infrastructure renewal projects is shown in Figure II.2. At the 



Figure II.2 MIT DOF Value Tree for infrastructure 
renewal projects. [Karydas and Gifiin, 2002] 


top of the value tree is the overall goal. In this example the Department of Facilities 
developed the value tree specifically as a decision tool to help the decision makers prioritize 





























infrastructure renewal projects. [Karydas and Gifun, 2002] Below the overall goal are the 
fundamental objectives. Next down the tree are the means objectives, where appropriate. 
Finally, the lowest level contains the performance measures. The number of elements and 
even the number of levels in the tree varies depending on the complexity of the decision and 
the desires to the decision maker. 

Performance measures, sometimes referred to as attributes, are used to determine the 
extent to which the objectives are satisfied. Natural scales often exist for the assessment of 
PMs, like dollars for an economic objective or lost work days for a safety objective. When 
natural scales are not obvious, or not convenient, constructed scales are often used. [Keeney 
and Merkhofer, 1987] Often times the decision maker would prefer to use constructed scales 
for all the performance measures, even the ones with clearly defined natural scales. 
Constructed scales reduce the difficulty of assessment and allow the decision maker to 
combine multiple metrics into a single PM. A constructed scale is divided into zone levels 
with a description of the criteria appropriate to that level. The number of levels in each 
constructed scale is determined by the decision maker, but there should be sufficient levels to 
provide accurate results and not so many levels that the decision maker is overwhelmed. 
Constructed scales are developed for all the performance measures. A preliminary 
constructed scale from the analysis of infrastructure networks, for physical property damage, 
is shown in Table ILL 


Level 

Description 

3 

Catastrophic physical property damage. 

Greater than $10 million 

2 

Major physical property damage 
$1 million to $10 million 

1 

Minor physical property damage 

Less than $1 million 

0 

No physical property damage 


Table II. 1 Preliminary Constructed Scale for physical property damage 


The decision maker next assigns weights to the performance measures using the 
Analytic Hierarchy Process (AHP.) [Saaty, 1980] The decision maker begins with a series of 










pair-wise comparisons between the fundamental objectives with respect to the primary goal. 
The comparisons are made using linguistic scale shown in Table II.2. 


Intensity of 
Importance 

Definition 

Explanation 

1 

Equal importance 

Two activities contribute equally to the 
objective. 

3 

Weak importance of one 
over another 

Experience and judgment slightly favor one 
activity over another. 

5 

Essential or strong 
importance 

Experience and judgment strongly favor one 
activity over another. 

7 

Very strong or 
demonstrated importance 

An activity is favored very strongly over 
another; its dominance demonstrated in 
practice. 

9 

Absolute importance 

The evidence favoring one activity over 
another is of the highest possible order of 
affirmation. 

2,4,6,8 

Intermediate values 

When compromise is needed. 


Table II.2 AHP Comparison scale [Saaty, 1980] 


After completing the comparisons among the fundamental objectives, the decision maker 
moves down the value tree analyzing each level of objectives. The weight of the fundamental 
objective is passed down the value tree to the objectives below, with the weight being split 
among the objectives using AHP. [Weil and Apostolakis, 2001] The value tree is completed 
when all weights have been passed down the tree to the performance measures. The value 
tree is examined for consistence in AHP, with the decision maker determining the 
inconsistencies and correcting the value tree to eliminate them. [Saaty, 1980] The weights 
are converted into a 0 to 1 scale using a linear transformation. The weights for the DOF value 
tree for infrastructure renewal projects. Figure II.2, are shown in Table II.3. The local weight 







describes the value of the objective, in relation to its siblings, to its parent objective. The 
global weight describes the value of the objective to the overall goal. 


Objective 

Local 

Weight 

Global 

Weight 

I. Impact on Health, Safety, and the Environment 


0.491 

A. Impact on People 


0.295 

B. Impact on the Environment 


0.196 

II. Economic Impact of the Project 

0.233 

0.233 

C. Economic Impact on Property, Academic and 

0 600 

0 140 

Institute Operations 



1. Physical Property Damage 

0.210 

0.029 

2. Intellectual Property Damage 

0.550 

0.077 

3. Interruption of Academic Activities and 

0 240 

0.034 

Operations 



a. Interruption Time 

0.500 

0.017 

b. Complexity of Contingencies 

0.500 

0.017 

D. Loss of Cost Savings 

0.400 

0.093 

III. Coordination with Policies, Programs, and 

0.276 

0.276 

Operations 



E. Impact on Public Image 

0.500 

0.138 

4. Internal Public Image 

0.400 

0.055 

5. External Public Image 

0.600 

0.083 

F. Programs Affected 

0.500 

0.138 


Table II.3 Value tree weights for infrastructure renewal projects [Karydas and Gifun, 2002] 


With the value tree and weights established, the decision maker assesses the disutility 
functions associated with the performance measures. The AHP is applied to the constructed 
scale for each performance measure to develop the disutility function. [Hughes, 1986] For 
each PM, the process follows the familiar pair-wise comparisons of the levels in the 
appropriate constructed scale. Once the weights have been assigned, and passed consistency 
checks, they are converted into a 0 to 1 scale by a linear transformation. The worst case 
disutility has the value 1 (full impact of the PM), and the least case disutility has the value 0 
(no impact from the PM.) A constructed scale from the analysis of infrastructure networks, 
for physical property damage, which the disutility weights included, is shown in Table II.4. 












Level 

Description 

Disutility 

3 

Catastrophic physical property damage 

Greater than $10 million 

1.00 

2 

Major physical property damage 
$1 million to $10 million 

0.27 

1 

Minor physical property damage 

Less than $1 million 

0.03 


No physical property damage 

0.00 


Table II.4 Constructed Scale for physical property damage 


Once the value tree (including all weights) and the constructed scales (with disutility 
values) are complete the decision maker checks for consistency across the PMs. For 
example, compare the decision makers’ preferences between physical property damage and 
impact on the environment, constructed scale displayed in Table II. 5. The contribution 


Level 

Description 

Disutility 

3 

Major Environmental Impact 

1.00 

2 

Moderate Environmental Impact 

0.34 

1 

Minor Environmental Impact 

0.04 

0 

No Environmental Impact 

0.00 


Table II. 5 Constructed Scale for environmental impact 


to the overall assessment from each performance measure is the product of the weights of the 
PM and the disutility from the constructed scale. Comparing major physical property damage 
with a minor environmental impact reveals the contribution from each PM to the overall goal 
to be equal (less than 0.1% difference.) 

PI (physical property damage) = weight (0.029) * disutility (0.27) = 0.00783 
PI (environmental impact) = weight (0.196) * disutility (0.04) = 0.00784 


























So, the decision maker should be indifferent to suffering major physical property damage or 
minor environmental impact. If not, the decision maker may adjust the value tree weights and 
constructed scales disutility values until consistency is satisfied. 

Finally, the decision analysis tool is benchmarked to validate the results. The 
prioritization tool is applied to several previously investigate cases and the results are 
compared to the historical data. The comparison serves to satisfy the decision maker that the 
prioritization tool is producing the desired results. 



II.3 Networks and Minimal Cut Sets 

In the search for understanding the vulnerabilities of critical infrastructures the 
concept of modeling the infrastructures as networks has been discussed. [Pate-Comell and 
Gikema, 2002; Amin, 1999; Ezell, et al, 2000; Ballocco, et al, 2003] The network model and 
underlying graph theory provides for mathematical analysis of the infrastructures in the effort 
to identify the critical locations. 

A graph G is an ordered triplet (V(G), E(G), Tq) consisting of a nonempty set V(G) of 
vertices, a set E(G), disjoint from V(G), of edges, and an incidence function *4^Gthat 
associates with each edge of G an unordered pair of (not necessarily distinct) vertices of G. If 
e is an edge and u and v are vertices such that ^G{e)=u,v then e is said to join u and v; the 
vertices u and v are called ends of e. [Bondy and Murty, 1980] 

For example, let 

G-(V(G),E(G), 

where 

V(G) = {vl, v2, v3, v4, v5, v6, v7, v8} 

E(G) = {el, e2, e3, e4, e5, e6, e7, e8} 

4^G(el) = vl,v2 4^G(e2) = v2,v3 'PG(e3) = v3,v4 H^G(e4) = v2,v5 

MJG(e5) = v5,v7 M^G(e6) = v5,v6 ^^G(e7) = v7,v8 H^G(e8) = v6,v8 



Figure II.3 Diagram of graph G 









For any graph H, with v vertices and e edges, there corresponds a vxe matrix called the 
incident matrix of H. The incident matrix M(H) = [my], where my is the number of times (0, 

1, or 2) that v\ and ej are incident [Bondy and Murty, 1980]. When my equals 0, the vertex i 
and the edge j are not incident. When my equals 1, edge j either begins or ends at the vertex i. 
When my equals 2, edge j both begins and ends at the vertex i, making edge j a loop. For the 
graph G shown in Figure II.3 the incident matrix M(G) is displayed in Table 11.6. The incident 
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v6 

0 

0 
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0 
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v7 
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0 

0 

0 

1 

0 

1 
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v8 

0 

0 

0 

0 

0 

0 

1 
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Table II.6 Incident matrix M(G) for graph G 

matrix is created to serve as the input table for computer analysis. This project employed 
Mathematica® as a graph analysis tool. 

Two vertices u and v are connected if there is a path between them. In graph G 
vertices v5 and v4 are connected along path v5, e4, v2, e2, v3, e3, and v4. A cut edge (vertex) 
is an edge (vertex) that, if removed from the graph, would separate the graph into two distinct 
sections, having no path between them. A terminal vertex, i.e., a vertex with only one 
incident edge, can be a cut vertex in that it would separate that vertex from the rest of the 
graph. Examples of cut edges in graph G include edges el, e2, e3, and e4; cut vertices 
include vertex vl, v2, v3, v4, v5, and v8. Edges e5, e6, e7, and e8 are not cut edges since the 
removal of one of them does not separate the graph. Similarly, vertices v6 and v7 are not cut 
vertices. A cut set K is a set of components (edges and/or vertices) that, if removed from the 
graph, would separate the graph into two distinct sections. [Bondy and Murty, 1980] 

The discussion of edges has assumed the path to be bi-directional. For example, in 
graph G vertex v3 may be reached from vertex v3 via edge e2, and vertex v2 may be reached 
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from vertex v3 via edge e2 (in the opposite direction.) In such cases, graph G is non-directed, 
i.e., the edge allows “flow” in either direction. In some problems, such as interstate traffic 
flow or some utility distribution systems, the edges in the graph should be modeled to allow 
flow in one direction only. A directed graph D is an ordered triplet (V(D), A(D), M^d) 
consisting of a nonempty set V(D) of vertices, a set A(D), disjoint from V(D), of arcs, and an 
incidence function 4^0 that associates with each arc of D an ordered pair of (not necessarily 
distinct) vertices of D. If a is an arc and u and v are vertices such that '+’D(a)=w,v then a is 
said to join u and v; u is the tail of a and v is its head. [Bondy and Murty, 1980] Arc a allows 
flow from vertex u to vertex v, but not from vertex v to vertex u. A directed graph is 
frequently referred to as a digraph. [Bondy and Murty, 1980] 

For example, let 

D = (V(D), A(D), 4^d) 

where 

V(D) = {vl, v2, v3, v4, v5, v6, v7, v8} 

A(D) = {al, a2, a3, a4, a5, a6, a7, a8} 

4^D(al) = vl,v2 4^D(a2) = v2,v3 4^D(a3) = v3,v4 4^D(a4) = v2,v5 

4^D(a5) = v5,v7 4JD(a6) = v5,v6 4JD(a7) = v7,v8 TD(a8) = v6,v8 



Figure II.4 Diagram of digraph D 









Digraphs have an incident matrix similar to graphs. The incident matrix N(H) = [ny], 
where ny (-1, 0,1, or 2) is the incidence relationship between vertex Vi and arc aj [Bondy and 
Murty, 1980]. When ny equals 0, the vertex i and the arc j are not incident. When ny equals 
1, the head of arc j is incident with vertex i. When ny equals -1, the tail of arc j is incident 
with vertex i. When ny equals 2, arc j both begins (tail) and ends (head) at the vertex i, 
making arc j a loop. For the digraph D shown in Figure II.4 the incident matrix N(D) is 
displayed in Table II.7. 
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v6 

0 

0 

0 

0 

0 

1 

0 
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v7 
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0 

0 

0 

1 

0 

-1 

0 


v8 

0 

0 

0 

0 

0 

0 

1 

1 


Table II.7 Incident matrix N(D) for digraph D 

Similar to the discussion concerning graphs, in a digraph two vertices u and v are 
connected, if there is a directed path between them. In digraph D, vertex v4 is connected to 
vertex v2 along the directed path v2, a2, v3, a3, and v4. But, vertex v2 is not connected to 
vertex v4 because there is not a directed path from vertex v4 to vertex v2. The concept of a 
cut arc (vertex) is the same for digraphs as graphs. 

To model an infrastructure, say water distribution, with a digraph, we let vertices 
represent the valves, branches in the pipe, and the sources (supply vertices) and sinks (user 
vertices.) Arcs represent the water pipes. We are interested in identifying the events that 
interrupt service to the users. Let digraph D represent a water distribution system. Figure II.5, 
with one supplier (vertex vl) and two users, user A (vertex v4) and user B (vertex v8.) The 
supply node may be the actual water pumping station or it may just be a point in the water 
distribution network. In either case, the vertex is treated the same in the digraph analysis. We 
want to identify the cut sets (cut arcs and vertices, and sets of cut arcs and vertices) that 
interrupt service to each user. If the infrastructure service is interrupted from the user, we will 
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Figure II.5 Digraph D of a water distribution network 


consider the system to have failed, and we are interested in the cut set(s) responsible for that 
failure. For a set of components (arcs and vertices) C = {1,2, 3,n}. A cut set K is a set of 
components in C, which by failing causes the system to fail, interrupts the infrastructure 
service to the user. A cut set is said to be minimal if it cannot be reduced without losing its 
status as a cut set [Bondy and Murty, 1980; Hoyland and Rausand, 1994] 

For the analysis of infrastructures we will examine the cuts sets associated with each 
user. For example, analyzing digraph D in Figure II.5 for user A would produce many cut 
sets, Ka = {(a2), (a2,v3), (a2,a3), (a3,v3),..The cut sets that can be reduced, i.e., (a2,v3) 
and (a3,v3), are not minimal cut sets. The cut sets that cannot be reduced, i.e., (a2) and (a3), 
are minimal cut sets. 


Minimal Cut Sets for digraph D in Figure II.5 are 

User A, Ka = {(al), (a2), (a3), (vl), (v2), (v3), (v4)} 

User B, Kb = {(al), (a4), (vl), (v2), (v5), (v8), (a6,a5), (a6,v7), (a6,a7), 

(a8,a5), (a8,v7), (a8,a7), (v6,a5), (v6,v7), (v6,a7)} 

In analyzing the infrastructure network (digraph) for all users we are interested in 
discovering those cut sets which have the greatest impact, those which, when successfully 
attacked by terrorists, cause the greatest disutility among the user community. When looking 
at Figure II.4 one can intuitively see that cut sets (al), (vl), and (v2) are more important than 
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any of the others because their loss causes an interruption of service to both user A and user 
B. Inspection is sufficient for very small system, but the decision maker would quickly 
become overwhelmed as the size of the infrastructure grows. 



II.4 Risk Analysis Model 

The Risk Analysis Model from the National Infrastructure Protection Center, NIPC, 
[NIPC, 2002] forms the framework for the assessment of the MIT infrastructure. This model 
follows the following five steps: Asset Assessment, Threat Assessment, Vulnerability 
Assessment, Risk Assessment, and Identification of Countermeasure Options. The 
Infrastructure Critical Location Risk Analysis Methodology, outlined in Figure II.6, is a 
decision analysis tool to assist the decision makers to fully evaluate the terrorism risk to the 
MIT community. 
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Figure II.6 Infrastructure Critical Location 
Risk Analysis Methodology 
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11.4. A Asset Assessment 

Asset Assessment is the process of understanding the “value” of the organization 
being analyzed. In the case of infrastructures the value is divided into distinct categories. 
First is the value of the infrastructures themselves. For example, the Hoover Dam has a 
certain value based on the repair or replacement costs (i.e. excavation, concrete, steel, 
machinery, and so on). Hoover Dam also has value because it is a national monument, which 
classifies it as a key asset. Additionally, the dam has value from the services is provides to 
the infrastructure users. It supplies electricity to the national electric grid, and recreation to 
the users of Lake Meade. In many cases the contribution to the infrastructures, and the 
associated end users, will significantly outweigh the repair costs or monumental “costs.” The 
asset value can be expressed in terms of consequences of an undesirable event impacting a 
user. A detailed asset assessment of the MIT community was conducted by the MIT 
Department of Facilities. [Karydas and Gifun, 2002] This assessment established a baseline 
value of the assets, and will he discussed further in a following section. 

11.4. B Threat Assessment 

The Threat Assessment is specific to the community assets as established during the 
Asset Assessment. In a traditional threat assessment, the analyst would consider threats from 
all sources, including natural disasters, accidents, and human-generated attacks. This project 
is focused on the terrorist threat and, therefore, it is limited to human-generated malicious 
attack. The Threat Assessment requires identification and detailed assessment of the 
adversaries. For the MIT community the threat could be an international terrorist group, 
domestic terrorists, disgruntled community members, or others. For each threat (or threat 
group) the analyst Avill normally assess the intent, capability, as history of success of the 
particular adversary to develop a profile for the threat. The specific Threat Assessment is left 
to the security specialists, and additional details are not discussed here. 

For this analysis of the MIT community we will make use of three threat profiles. 
These profiles are not the result of detailed threat assessments of security specialists, and 
should not be considered real life threats to MIT. The threat profiles are chosen to represent a 
few of the possibilities facing the community. The three scenarios we examine are; 
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Major Threat A major threat is from an organization, group, or individual 
with significant capabilities. The threat may constitute a 
severe pinpoint attack against one or more infrastructures or 
a coordinated multi-axis attack against multiple locations. 
The attack would result in damage requiring long term 
restoration (greater than 1 month) and causing significant 
impact on the community. 

Moderate Threat A moderate threat is from a capable organization, group, or 
individual. The threat may constitute a pinpoint attack 
against one or more infrastructures or a coordinated multi¬ 
axis attack against two locations. The attack would result in 
damage requiring short term restoration (less than 1 month) 
and causing moderate impact on the community. 

Minor Threat A minor threat is from an organization, group, or individual 
with limited capabilities. The threat may constitute a single 
pinpoint attack against one or more infrastructures. The 
attack would result in minor damage requiring minimal 
restoration (less than one week) and causing minor impact on 
the community. 


II.4.C Vulnerability Assessment 

Vulnerability is defined as the susceptibility of an entity to attack. The Vulnerability 
Assessment reviews the environment to develop an imderstanding of the system weaknesses. 
In the case of critical infrastructures the analyst identifies and characterizes exploitable 
situations in these infrastructures. Susceptibilities may appear as poor access controls, such as 
open systems connected to the internet or the physically open MIT community. The lack of 
locks, guards, or security procedures is a potential vulnerability. The Vulnerability Analyst 
typically asks the question, “If I were a terrorist, I would...” This leads to a vide variety of 
points for consideration as initiating events. 

Through the application of expert judgment vulnerability may be classified into broad 
categories to assist the analyst in describing the systems. Definitions for each category will 
depend on the specific environment and threat. An example of susceptibility classifications is 
presented in Table II.8. 




Level 

Description (examples) 

Extreme 

Completely open, no controls, no barriers 

High 

Unlocked, non-complex barriers (door or access panel) 

Moderate 

Complex barrier, security patrols, video surveillance 

Low 

Secure area, locked, complex closure 


Guarded, secure area, locked, alarmed, complex closure 

Zero 

Completely secure, no vulnerability (very unlikely) 


Table II.8 Susceptibility categories 


A second piece to the understanding of vulnerability is the importance of the point 
being described. Consider that a street light, which is completely open with no controls or 
barriers for protection, is extremely susceptible to attack. This would lead to initially 
classifying the street light as extremely vulnerable. However, to complete the description the 
analyst must consider the “value” of the street light. The replacement costs of the bulb, or 
even the entire light, are minimal. The street light is not a key asset, nor does it hold any 
monumental value. The likelihood of the loss of a street light cascading through the electrical 
distribution system is extremely small. There are some societal costs for continuing life with 
the street light out, but they should also be minor. So, while the street light is extremely 
susceptible to an attack it has very low value in the environment. Therefore, the street light is 
not a point that should be considered a critical location. The vulnerability of a point is a 
function of the susceptibility to attack and the value (from the asset assessment) of the point 
in the environment (infrastructure.) Vulnerability = / (Susceptibility, Value). Vulnerability 
categories are defined in Table II.9 and described in Table II. 10. 
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Blue 
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Green 

Green 

Green 

Green 

Zero 

Green 

Green 

Green 

Green 

Green 

Green 


Table II.9 Vulnerability Categories 
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Vulnerability 

Description 

Red 

This category represents a sever vulnerability in the infrastructure. It is 
reserved for the most critical locations. Red vulnerabilities are those 
requiring the most immediate attention and prompt action. 

Orange 

The Orange vulnerability condition is the second priority for counter 
terrorism efforts. These locations are generally moderately to extremely 
valuable and moderately to extremely susceptible. 

Yellow 

The Yellow vulnerability condition is the third priority for counter 
terrorism efforts. These locations are normally less vulnerable because 
they are either less susceptible or less valuable that the terrorist desires. 

Blue 

The Blue vulnerability condition is the fourth priority for counter 
terrorism efforts. 

Green 

This is the final category for action. It gathers all locations not included 
in the more sever cases, typically those which are low (and below) on 
the susceptibility scale and low (and below) on the value scale. It is 
recognized that constrained fiscal resources is likely to limit efforts in 
this category, but it should not be ignored. 


Table II. 10 Vulnerability descriptions 


IL4.D Risk Assessment 

The Risk Assessment brings all the details together to provide the decision maker with 
a framework to analyze the community and understand the global risk. A prioritized list of 

• infrastructure vulnerabilities is produced dependent upon the value of the assets, the threat 
specified by the security specialist, and the vulnerability of the infrastructures. The decision 
makers analyze the specified threat using the value tree and constructed scales developed 

^ during the Asset Assessment. A performance index (PI) table is compiled to represent the 

disutility of each user for each infrastructure. An example and full description of the PI table 
is presented in Table III.8, in section III.C. The decision maker combines the susceptibility of 
the infrastructures with the value, represented by the performance index, to produce a 

• prioritized list of infrastructure vulnerabilities. 
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11.4. E Identiflcation of Countermeasure Options (Risk Management) 

Risk management build on the risk assessment process by seeking answers to a second 
set of three questions [Haimes, 1991]; 

• What can be done and what options are available? 

• What are the trade-offs in terms of costs, benefits, and risks? 

• What are the impacts of current management decisions on future operations? 

Countermeasures are intended to lower the overall risk to the assets. For each countermeasure 
the analyst must review the impact on each assessment for the entire community of assets. 

The risk assessment is repeated to account for the impact of the countermeasure. In assessing 
the countermeasure options, the analyst must ensure to account for the ongoing cost of the 
countermeasure. Also, it is important to account for any negative contribution the 
countermeasure may have to the overall risk. For example, many infrastructures run 
underground and are accessible via manholes. To protect services in a manhole the analyst 
may recommend welding the manhole covers in place to prevent unauthorized access. The 
ongoing cost of cutting the weld and re-welding the cover whenever access is required must 
be considered. Additionally, any cost (additional damage) incurred while emergency 
personnel wait to cut the weld to gain access to the manhole must be accounted for in the 
analysis. 

11.4. F Continuous Assessment 

Risk Assessment is not a one-time event, is must be a continuous process to achieve 
success. The analyst is required to vigilantly monitor the environment for changes that could 
impact the analysis. Asset values may change leading to a shift in consequences. New threats 
may emerge, old threats may fade away. Vulnerability may also change. Continuous 
assessment is necessary to timely address new risks. 
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III. Screening Methodology for Critical Infrastructures 
III.l Overview 

To analyze infrastractures for vulnerabilities this project models each of the MIT 
campus infrastructures as an interconnected digraph. Arcs represent conduits for service, i.e. 
pipes for water and natural gas, and electrical cable for electricity. Vertices represent 
everything else in the infrastructure, including suppliers, users, pumps, valves, switches, and 
branches. Additionally, service access points are modeled as vertices. The impact of losing a 
service is modeled by the Performance Index (PI) measured through the disutility of the user 
losing the service. The PI is determined through analysis of the individual users with a value 
tree and performance measure constructed scales. Each user is analyzed to determine the 
minimal cut sets (mcs), arcs and vertices, which produced an interruption of an infrastructure 
supplied service. A mcs may be impact more than one user and/or more than one 
infrastructure. Once all the users have been examined, a database is compiled of the mcs, 
with the associated PI representing the “value” of the mcs to the infrastructure. The 
susceptibility of each mcs is assessed and combined with the value of the mcs to produce a 
vulnerability assessment of the mcs. A prioritized list of mcs for consideration is developed. 

The infrastructure analysis model is a decision analysis tool to assist the decision 
maker in identifying the critical locations in infrastructures. The methodology for the 
efficient prioritization of infrastructure renewal projects [Karydas and Gifun, 2002] served as 
a starting point for the identification of critical locations in infrastructures. Through the 
application of expert judgment the value tree for the efficient prioritization of infrastructure 
renewal projects was modified to serve as the value tree for the identification of critical 
locations in infrastructures. The constructed scales for the analysis of the performance 
measures were adapted from the infrastructure renewal project for use in the critical location 
analysis. Network models of the selected infrastructures were developed and analyzed using 
graph theory to identify potential critical locations, i.e. the points in the network which, if lost, 
would lead to the greatest disutility among the user community. The susceptibility of the 
infrastructure network points were analyzed and combined with the performance index to 
establish the vulnerability of each location. Prioritization of the vulnerability list leads to the 
identification of critical locations in infrastructures. 
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IIL2 The Value Tree 

The Value Tree developed by the Department of Facilities (DOF) for the prioritization 
of infrastructure renewal projects is shown in Figure II.2. The objective and performance 
measure weights for the value tree were developed through expert judgment in workshops 
organized by DOF and are shovm in Table II.3. The value tree and associated weights were 
developed using the AHP [Karydas and Gifun, 2002; Saaty, 1980] as described in section II.2. 
The value tree is hierarchical in nature, i.e. information is passed from an objective to its 
parent or children, and there is no information flow from an objective directly to a sibling. 
Recall, the local weight represents the contribution by the objective to its parent objective, 
and the global weight represents the contribution by the objective to the overall objective. 

The DOF value tree contains many objectives and performances measures that are 
appropriate for the identification of critical locations in infrastructures. Rather than starting 
from ground zero, we adapted the DOF value tree into a value tree for the identification of 
critical locations in infrastructures. A review was conducted on the DOF value tree to assess 
the applicability of the objectives. Loss of Cost Savings, objective II-D, does not apply. This 
objective captures the economic loss incurred if a particular infrastructure renewal project is 
not completed. For example, consider a section of water supply piping that requires periodic 
maintenance to flush the water lines to prevent the build-up of undesirable material. A 
renewal project could replace the water supply line with an advanced material and eliminate 
the required periodic system flush, saving maintenance costs. There would be some impact to 
the community during the project to replace the piping, which would be modeled with the 
value tree. A decision not to replace the piping would generate a “loss of cost savings” as the 
periodic maintenance flush would be required to continue. The Loss of Cost Savings 
objective would capture that value. For a terrorist event there is no opportunity to experience 
a “loss of cost savings,” so that objective requires elimination. 

Additionally, Complexity of Contingencies, objective II-C-3-b, does not apply. This 
objective is designed to capture the pre-planning impact costs of a renewal project. For 
example, replacement of floors in a building with Asbestos tiles requires relocation of the 
building activities. The cost to relocate the users, such as establishing temporary laboratories, 
computing facilities, offices, and classrooms is modeled in the Complexity of Contingencies 





objective. The actual impact from temporary relocation is captured in objective II-C-3-a, 
Interruption Time. Action taken in response to an immediate terrorist threat is not considered 
in the complexity of contingencies objective, but is accounted for in the vulnerability 
assessment. No additional objectives were identified, therefore none was added. 

The two objectives, Loss of Cost Savings and Complexity of Contingencies, are 
eliminated from the value tree for terrorist event impact. The Loss of Cost Savings objective 
is eliminated first. Figure III. la shows a portion of the DOF value tree with the changes 



Figure III.la DOF Value Tree (portion) 
[Karydas and Gifun, 2002] 


Figure III.lb Value Tree (portion) 


outlined. The Loss of Cost Savings is simply eliminated and the Impact on Property, 
Academic, and Institute Operations is absorbed by the Economic Impact objective. The 
Economic Impact is renamed as the Economic Impact on Property, Academic, and Institute 
Operations to more accurately reflect the objective. Figure III. lb. 










The Complexity of Contingencies objective was eliminated following the same 
process. Figure IIL2a shows a portion of the DOF value tree with the changes highlighted. 
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Figure III.2a DOF Value Tree (portion) 
[Karydas and Gifun, 2002] 


Figure III.2b - Value Tree (portion) 


The Complexity of Contingencies objective w^as simply eliminated and its sibling, 
Interruption Time, was absorbed by the Impact on Property, Academic, and Institute 
Operations, Figure IIL2b. Additionally, Coordination with Policies, Programs, and 
Operations, objective III, was renamed Stakeholder Impact to more accurately reflect the 
fundamental meaning of the impact category in the terrorism analysis. 

The final value tree for the Impact of a Terrorist event is shown in Figure IIL3. This 
value tree looks like it would if we had started from scratch and followed the decision 
analysis process described in section 11.2. It represents the decision maker’s fundamental 
objectives necessary in order to analyze the vulnerability of MIT community from terrorist 
activities. The value tree developed by a different decision maker may look different, as 
would a value tree we designed to analyze a different problem. 
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Figure III.3 Value Tree for Impact of Terrorism 


The intent of this analysis is to identify the critical locations in infrastructures. We 
have replaced the classification “objective” with “impact categories” as it is more 
representative of the nature of this methodology. We assigned the value tree weights using 
the AHP as discussed in section II.2. Since many of the impact categories and performance 
measures were carried over from the infrastructure renewal project the weights associated 
with those attributes were used as a starting point. The importance of the three impact 



















categories worked out the same for the two projects. And, the weight of the Economic Impact 
on Property, Academic, and Institute Operations (Economic Impact in the DOF value tree) 
remains unchanged with respect to the sibling impact category (Impact on Health, Safety, and 
the Environment; and Coordination with Policies, Programs, and Operations). The Economic 
Impact on Property, Academic, and Institute Operations objective retains weight 0.233. 

In the DOF value tree the impact on property, academic, and institute operations 
carries 60 percent of the economic impact, and loss of cost savings accounted for the 
remaining 40 percent. The 60 percent passed to the impact on property, academic, and 
institute operations was further split among the three children (PMs.) The split allocated 21 
percent to physical property damage, 55 percent to intellectual property damage, and 24 
percent to interruption of academic activities and operations. So, the PM weight for 
intellectual property damage in the DOF value tree was determined by: 
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PM_ipd 


W 


econ_imp 
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impact_pai 


W; 


intel_prop_dam 


WpMjpd = 0-233 * 0.600 * 0.550 


WpMJpd = 0-077 


where 


WpMjpd is the global weight of the intellectual property damage PM. 

Weconjmp is the global weight of the economic impact fundamental impact category. 

Wimpact_pai is the fractional split of the economic impact dedicated to the impact 
on property, academic, and institute operations. 

Wintei_prop_dam is the fractional split of the impact on property, academic, and 
institute operations dedicated to intellectual property damage. 


The weight of the Loss of Cost Savings objective, just eliminated, was absorbed by the 
sibling objective (Impact on Property, Academic, and Institute Operations). The new 
fundamental impact category (Economic Impact on Property, Academic, and Institute 
Operations) passes its entire weight (0.233) to its new children (Physical Property Damage, 
Intellectual Property Damage, and Interruption of Academic Activities and Operations). The 
weight is split among the children in the same proportion as in the DOF value tree, where the 



three attributes were siblings. In the critical infrastructure value tree the PM weight for 
intellectual property damage in the DOF value tree is determined by: 


^PM_ipd '^eijai ^ intel_prop_dam 
"^PMJpd 


’^PMjpd - 0*128 


where 


WpMjpd is the global weight of the intellectual property damage PM. 

Weijjai is the global weight of the economic impact on property, academic, 
and institute operations fundamental impact category. 

Wintei_prop_dam is the fractional split of the economic impact on property, academic, 
and institute operations dedicated to intellectual property damage. 


The weight of the Complexity of Contingencies objective, eliminated, was absorbed 
by the sibling objective (Interruption Time), leaving the objective for the Interruption of 
Academic Activities and Operations with one performance measure (Interruption Time). The 
PM was merged with the objective, creating a new performance measure (Interruption of 
Academic Activities and Operations.) The weight of the objective (Interruption of Academic 
Activities and Operations) in the DOF value tree becomes the local weight of the PM in the 
terrorism value tree. The global weight is recalculated following the method illustrated for 
the intellectual property damage PM. 

The terrorism value tree. Figure III.3, and weights. Table III.l, are specific to 
the MIT campus and the particular decision makers conducting the analysis. These tools, the 
impact categories, value tree, and weights are specific to the MIT community analysis for the 
identification of critical locations in infrastructures. Application of this methodology in 
another environment would require development of applicable impact categories, value tree 
and weights. 




Impact Category 

Local 

Global 


Weight 

Weight 

I. Impact on Health, Safety, and the Environment 

0.491 

0.491 

A. Impact on People 

KM 

0.295 

B. Impact on the Environment 


0.196 

II. Economic Impact on Property, Academic and 

0.233 

0.233 

Institute Operations 

C. Physical Property Damage 



D. Intellectual Property Damage 


0.128 

E. Interruption of Academic Activities and 
Operations 



III. Coordination with Policies, Programs, and 
Operations 

0.276 

0.276 

F. Impact on Public Image 

0.500 

0.138 

1. Internal Public Image 

0.400 

0.055 

2. External Public Image 

0.600 

0.083 

G. Programs Affected 

0.500 

0.138 


Table III.l Value Tree impact category and performance measure weights 






III.3 Disutility and Constructed Scales 

In the standard application of Decision Analysis the utility function produces a 
measure of preference. In this case the desire to avoid undesirable outcomes led to the 
employment of disutility, i.e., the higher the disutility value the lower the desirability. The 
most and least desirable levels are represented by the extreme values of d=0 and d=l, 
respectively. The impact of each event is evaluated against the performance measures defined 
in the value tree. The constructed scales developed by the DOF were used as a starting point 
for the critical infrastructure analysis. DOF generated the constructed scales by following the 
AHP method described in section II.2. We applied the AHP methods as described in section 
II.2 in developing the constructed scales for the identification of critical locations in 
infrastructure value tree. 

Constructed scales for physical property damage and environmental impact were 
presented in Table II.4 and Table II.5 respectively. The remaining constructed scales are 
displayed in Tables III.2 through III.7. 


Level 

Description 

Disutility 

4 

Extreme Interruption 

Greater than 6 months, entire buildings evacuated and 
activities relocated. 

1.00 

3 

Major Interruption 

1 to 6 months, laboratories evacuated and activities 
relocated. 

0.57 

2 

Moderate Interruption 

1 to 4 weeks, specialty classrooms evacuated and 
activities relocated. 

0.19 

1 

Minor Interruption 

Less than 1 week, a few administrative units or small 
classrooms evacuated and activities relocated. 

0.06 

0 

No Interruption 

0.00 


Table III.2 Constructed Scale for interruption of academic activities & operations 















Level 

Description 

Disutility 

3 

Fatality or Lethal Exposure 

Ex. Roof Collapse, Falling Brick, Inhalation of Gas 

1.00 

2 

Major Exposure with Long Term Effects 

Ex. Lead Poisoning 

0.46 

1 

Minor Injury or Exposure 

Ex. Broken Arm, Laceration 

0.05 

0 

No personal injury 

0.00 


Table III.3 Constructed Scale for impact on people 



Description 

Disutility 

3 

Catastrophic intellectual property damage 

Long-term experiments 

1.00 

2 

Major intellectual property damage 

Artifacts and rare documents 

0.46 

1 

Minor intellectual property damage 

Non-backed up electronic data 

0.05 

0 

No intellectual property damage 

0.00 


Table III.4 Constructed Scale for intellectual property damage 


Level 

Description 

Disutility 

3 

Major degree of adverse publicity 

Petitions, sit-ins, demonstrations 

1.00 

2 

Moderate degree of adverse publicity 

Negative articles published 

0.34 

1 

Minor degree of adverse publicity 

Verbal complaints 

0.04 

0 

No adverse publicity 

0.00 


Table IIL5 Constructed Scale for internal public image 
































Level 

Description 

Disutility 

3 

Major degree of adverse publicity 

Affects enrollment, contributions, program funding, 
or faculty recruiting 

1.00 

2 

Moderate degree of adverse publicity 

National / International Media 

0.57 

1 

Minor degree of adverse publicity 

Local media 

0.06 

0 

No adverse publicity 

0.00 


Table III.6 Constructed Scale for external public image 


Level 

Description 

Disutility 

4 

Extreme Impact 

Greater than $20 million and/or impacting greater 
than 250 students 

1.00 

3 

Major Impact 

$10 million to $20 million and/or impacting 50 to 250 
students 

0.50 

2 

Moderate Impact 

$1 million to $10 million and/or impacting 5 to 50 
students 

0.23 

1 

Minor Impact 

Up to $1 million and/or impacting up to 5 students 

0.02 

0 

No Impact 

0.00 


Table I1I.7 Constructed Scale for programs affected 


Following completion of the value tree (including all weights) and the constructed 
scales (with disutility values) we checked for consistency across the PMs. For example, we 
compared our preferences between programs affected, Table III.7, and interruption of 
academic activities and operations. Table 111.2. The contribution to the overall assessment 
from each performance measure is the product of the weights of the PM and the disutility 
from the constructed scale. Comparing a moderate impact on programs affected with a major 
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interruption of academic activities and operations reveals the contribution from each PM to 
the overall goal to be very close. 

PI (programs affected) = weight (0.138) * disutility (0.23) = 0.0318 

PI (interruption of academic activities and operations) = 

weight (0.056) * disutility (0.57) = 0.0319 

The consistency check suggests that we should be indifferent to suffering a moderate impact 
on programs affected or suffering a major interruption of academic activities and operations. 
If we are not indifferent then we would adjust the value tree weights and constructed scale 
disutility values to reflect our preference. 

As another example we performed a three way comparison among intellectual 
property damage (major intellectual property damage), Table III.4, internal public image 
(major degree of adverse publicity), Table III.5, and interruption of academic activities and 
operations (extreme interruption). Table III.2. 

PI (intellectual property damage) = weight (0.128) * disutility (0.46) = .0589 

PI (internal public image) = weight (0.055) * disutility (1.00) = 0.0550 

PI (interruption of academic activities and operations) = 

weight (0.056) * disutility (1.00) = 0.0560 

The consistency check suggests we are indifferent to suffering a major degree of adverse 
publicity or an extreme interruption of academic activities and operations. Also, that we 
value major intellectual property damage as slight more damaging (these are disutilities) than 
a major degree of adverse publicity or an extreme interruption of academic activities and 
operations. If these do not reflect our preferences then we would adjust the value tree weights 
and constructed scale disutility values as necessary. 
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III.4 Network Models 

The infrastructures are modeled using networks to take advantage of existing network 
analysis in our investigation. For this study the analysis is limited to three interconnected 
hard infrastructures: Natural Gas, Water, and Electricity. Wireless networks, both telephone 
and data, present different challenges and are not addressed in this work. The original 
analysis contains actual locations and infrastructure designations that are MIT campus 
specific. The work presented in this report is from the MIT analysis, but the names and 
designators have been changed to prevent any inadvertent release of potentially sensitive 
information. 

Figure III.4 shows a portion on the Natural Gas distribution system. This section of 
the MIT community is isolable from the remainder of the natural gas distribution system with 
an isolation valve upstream of the Supply point. This particular section of the campus 



(3 Manhole Bldg E 


Figure III.4 Natural Gas distribution schematic (partial) 
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represents one supply and six users, five end users and one user (building F) configured to 
allow gas flow through to other portions of the network. 

The network representation of this portion of the natural gas distribution system 
is shown in Figure III.5. The network vertices, shown as circles, represent the supply, users, 
valves, branches, and manhole access points in the piping system. All connected vertices 
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Figure III.5 - Natural Gas distribution network digraph 


have one or more associated arcs. The vertices are numbered, inside the circles, for 
identification purposes to support network analysis. The arcs, shown as lines, represent the 
piping. All arcs have two, and only two, associated vertices. An arc may be incident to the 
same vertex at both its tail and head, in which case the arc forms a loop starting and ending at 
the same vertex. A dead end pipe would have an originating vertex and a dummy vertex at 
the “dead end.” The arcs are numbers, adjacent to each arc. 

The natural gas system contains few flow directors, such as check valves or pressure 
reducers. Direction of gas flow is determined by the pressure gradient. Normally the supply 










will be at relatively high pressure and user at relatively low pressure, so gas will flow from 
supply to user. The network is represented in the incident matrix shown in Table III.8. 

Natural Gas Arcs (ga) 



Table III. 8 Incident matrix for natural gas distribution 


Most arcs are directed, having a specific tail (-1) and head (1), because flow goes in one 
direction only. Some arcs, gal 6 for example, are non-directed. These arcs, indicated with 
two Is, one for each incident vertex, permit flow in either direction depending on the network 
configuration and pressure gradient. The natural gas distribution system contains two vertices 
(ev3 and ev8) which are part of the electrical distribution system. These vertices are electric 
manholes designed primarily to serve as access points to the electric distribution switching 
network. The natural gas piping runs through, or adjacent to, the two identified manholes. 

The electrical and natural gas networks are not physically connected at the manhole, but are 


geographically coincident. The two infrastructures are connected in cases where electricity is 
powering a natural gas pressurizing pump or a natural gas fired turbine is generating 
electricity. In the case of connected infrastructures the natural network modeling would use a 
vertex to model the incidence of the two networks. In modeling the MIT infrastructures, we 
included vertices to account for those geographic locations where two or more infrastructures 
are coincident. A vertex is also used to model the situations where an infrastructure is 
geographically coincident with itself For example, this can occur when two gas pipes (not 
physically connected to allow flow) are located in the same service man-way. 

Figure III. 6 shows a portion of the Water distribution system. This section of the MIT 
community is isolable from the remainder of the water distribution system with an isolation 
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Figure III.6 Water distribution schematic (partial) 











valve upstream of the Supply point. This particular section of the campus represents one 
supply and the same six users modeled in the natural gas network. 

The network representation of this portion of the water distribution system is shown 
in Figure III.7. The network vertices, shown as circles, represent the supply, users, valves. 
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Figure III.7 - Water distribution network digraph 


branches, and manhole access points in the piping system. All connected vertices have one or 
more associated arcs. The vertices are numbered for identification purposes to support 
network analysis. The arcs, shown as lines, represent the piping. 

The water system contains few flow directors, such as check valves or pressure 
reducers. Direction of water flow is determined by the pressure gradient. Normally the 
supply will be at relatively high pressure and user at relatively low pressure, so water will 
flow from supply to user. The network is represented in the incident matrix shown in Table 
III.9. All the water distribution arcs in the displayed section are directed, having a specific 
tail (-1) and head (1), because flow goes in one direction only. The water distribution 
network may have sections which allow water flow in either direction, similar to the natural 
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gas network discussed previously. In the case of non-directed flow, the arc is indicated with 
two Is, one for each incident vertex, permitting flow in either direction depending on the 
network configuration and pressure gradient. 

Water Arcs (wa) 



The water distribution system contains two vertices (ev8 and evil) which are part of 
the electrical distribution system. These vertices are electric manholes designed primarily to 
serve as access points to the electric distribution switching network. As with the natural gas 
piping passing through the electric manhole, the electrical and water networks are not 
physically connected at the manhole, but are geographically coincident. The modeling is 
consistent with the previous description. 



The MIT electrical system, both generation and distribution, is handled in the Central 
Utilities Plant. Major electrical buses are energized from the natural gas fired turbine 
generator or back-up generation. The electrical buses feed the electrical cables disbursed 
through campus to provide electricity to the users (buildings.) An electrical cable forms a 
loop on the campus, beginning at bus ‘A’, winding through campus in service ducts, and 
ending at bus ‘B.’ Electricity may originate from either bus. Switches places along the cable 
direct electricity to various buildings. The system is made up of a number of loops, with each 
loop providing electricity to several buildings. A schematic. Figure III. 8, shows two 


Supply Bus A Supply Bus B 



Building 


Figure III.8 Electrical distribution schematic (partial) 

distribution loops for the section of campus coinciding with the natural gas and water 
infrastructures. The loops are modeled vwth non-directed edges, as electricity can flow in 
either direction around the loop. The electric lines from the switches to the buildings are 
modeled with directed arcs, as electricity only flows from the distribution loop to the building. 

The network representation of these portions of the electrical distribution system are 
shown in Figure III.9 (loop one) and Figure III. 10 (loop two.) The network vertices, shown as 
circles, represent the supply, users, switches, branches, and manhole access points in the 


















Figure III.9 Electrical distribution network digraph (loop one) 



Figure III. 10 Electrical distribution network digraph (loop two) 
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cabling system. The vertices are numbered, inside the circles, for identification purposes to 
support network analysis. The edges and arcs, shown as lines, represent the electrical cables. 
The electrical service ducts run primarily underground and are accessible from a number of 
manholes located throughout campus. The manholes provide service access for technicians to 
conduct maintenance. The electric manholes (there is an independent set of 
telecommunications manholes on campus) are primarily associated with the electrical 
distribution system, however in some cases other infrastructure services run through or 
immediately adjacent to the manholes. Some of the manholes contain only cabling; these are 
modeled by a vertex with two incident arcs (or edges), and electricity simply flows through 
these manholes. Other manholes contain switches which accept electricity from either loop 
direction and provide current to the user (building.) These points are modeled by a vertex 
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Electric Arcs (wa) 


3 4 5 6 7 8 9 
0 0 0 0 0 0 0 
0 0 0 0 0 0 0 
1 -1 0 0 0 0 0 
1 0 1 0 0 0 0 
0 0 1-110 0 
0 1 0 0 0 0 0 
0 0 0 0 0 1 1 
0 0 0 0 0 0 0 
0 0 0 0 1 1 0 
0 0 0 1 0 0 0 
0 0 0 0 0 0 0 
0 0 0 0 0 0 1 
0 0 0 0 0 0 0 
0 0 0 0 0 0 0 
0 0 0 0 0 0 0 
0 0 0 0 0 0 0 
0 0 0 0 0 0 0 
0 0 0 0 0 0 0 
0 0 0 0 0 0 0 
0 0 0 0 0 0 0 
0 0 0 0 0 0 0 


10 11 12 13 14 15 
0 0 0 0 0 0 
0 0 0 0 0 0 
0 0 0 0 0 0 
0 0 0 0 0 0 
0 0 0 0 0 0 
0 0 0 0 0 0 
-1 0 0 0 0 0 
1 0 0 0 0 0 
0 0 0 0 0 0 
0 0 0 0 0 0 
0 0 0 0 0 0 
0 0 1 0 0 0 
0-11 10 0 
0 1 0 0 0 0 
0 0 0 1 1 0 
0 0 0 0 1 -1 
0 0 0 0 0 1 
0 0 0 0 0 0 
0 0 0 0 0 0 
0 0 0 0 0 0 
0 0 0 0 0 0 


16 17 18 19 20 
0 0 0 0 1 
0 0 0 0 0 
0 0 0 0 0 
0 0 0 0 0 
0 0 0 0 0 
0 0 0 0 0 
0 0 0 0 0 
0 0 0 0 0 
0 0 0 0 0 
0 0 0 0 0 
0 0 0 0 0 
0 0 0 0 0 
0 0 0 0 0 
0 0 0 0 0 
0 0 0 0 0 
1 0 0 0 0 
0 0 0 0 0 
110 0 0 
01-110 
0 0 10 0 
0 0 0 1 1 




Table III. 10 Incident matrix for electrical distribution (loop one) 



with three or more incident vertices to account for splitting the electricity flow. The incident 
matrices for loops one and two of the electrical distribution system are displayed in Table 
III. 10 and Table III. 11, respectively. 
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0 

1 

1 

-1 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 


39 

0 

0 

0 

1 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 


40 

-1 

1 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

1 

0 


41 

1 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 


42 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

1 

1 


Table III.l I Incident matrix for electrical distribution (loop two) 


We analyzed the network digraphs, using Mathematica®, to produce the minimal cut 
sets for each user for each infrastructure. The complete listing of mcs, by infrastructure and 
user, is provided in Appendix A. 1. When reviewing the complete listing of mcs the reader 
will find over 1,000 mcs listed. The list is meshed to account for mcs which impact more 
than one user and/or more than one infrastructure. For example the cut set (ea5,eal6) impacts 
electricity to two users, building A and building D. The user-infrastructure combination 




impacted by the mcs is recorded, the mcs listed once, and the duplicates are eliminated. A 
user-infrastructure combination refers to one infrastructure supplied to one user. For 
example, water service to building A is one user-infrastructure combination and water service 
to building B is another user-infrastructure combination. This example contains eighteen 
user-infrastructure combinations, three infrastructures (natural gas, water, and electricity) for 
each of six users (buildings A, B, C, D, E, and F.) We sorted and analyzed the sets using 
Microsoft Excel®. Following the elimination of duplicates, there remain 663 unique mcs for 
the section of the MIT community being analyzed. That is, there are 663 different locations 
(or combination of locations) that, if attacked, would lead to the loss of one or more 
infrastructures to one or more users. There are seven mcs which impact six user- 
infrastructure combinations. For example mcs (evl,ev2) impacts electrical service to all six 
buildings, and mcs (wvl5) impacts water to all six users. The complete breakdown of the 
number of user-infrastmcture combinations affected by mcs is shown in Table III. 12. While 
the mcs which impact the most user-infrastructure combinations would seem to provide hints 
as to the prioritization, the analysis is not complete until the vulnerability is incorporated. 


Number of mcs 

Number of user-infrastructure 
combinations impacted 

7 

6 

7 

5 

11 

4 

107 

3 

256 

2 

275 

1 


Table III. 12 mcs impact on User-Infrastructure combinations 





III.5 Critical Infrastructure Vulnerabilities 

Having completed the framework for the analysis of the infrastructures, we analyze 
the community for the specified threat. For this example, we will analyze for a minor threat, 
section II.4.B, which is from an organization, group, or individual with limited capabilities. 
The threat may constitute a single pinpoint attack against one or more infrastructures. The 
attack would result in minor damage leading to minimal restoration and causing a minor 
impact on the community. Using the constructed scales, we determined the level 
representative of the damage and impact. Looking at the constructed scale for the interruption 
of academic activities and operations. Table III. 13, for electrical service to building A, we 
classified the impact from the selected threat as level 1, minor interruption. So, if the attack 


Assessment 

Level 

Description 

Disutility 


4 

Extreme Interruption 

Greater than 6 months, entire buildings 
evacuated and activities relocated. 

1.00 


3 

Major Interruption 

I to 6 months, laboratories evacuated and 
activities relocated. 

0.57 


2 

Moderate Interruption 

1 to 4 weeks, specialty classrooms evacuated 
and activities relocated. 

0.19 


1 

Minor Interruption 

Less than 1 week, a few administrative vmits or 
small classrooms evacuated and relocated. 

0.06 


0 

No Interruption 

0.00 


Table III. 13 Constructed Scale for interruption of academic activities & operations 


caused an interruption in electrical service to building A, the contribution to the Performance 
Index, for building A electrical service, from the interruption of academic activities and 
operations would be the global weight of the performance measure (0.056) multiplied by the 
assessed disutility (0.06), which is 0.00336. 

The remaining constructed scales are used to determine the contribution from the other 
performance measures to the PI for electrical service to building A. When the summation 
















across all the PMs in completed, the resulting PI for electrical service to building A is 
0.02117. The other infrastructure services to building A are analyzed following the same 
methodology, resulting in a PI for natural gas service to building A of 0.00865 and a PI for 
water service to building A of 0.01477. Once the building A assessment was completed we 
analyzed the other five users (buildings B, C, D, E, and F) for each infrastructure by following 
the same process. The Pis are likely to be different because the users are heterogeneous, have 
different infrastructure service needs, and perform functions of differing value to the 
community. In this example building E and F are very similar, so there Pis are the same in 
many cases. The result is a PI for each of the eighteen user-infrastructure combinations 
considered in the example. The detailed constructed scales are provided in Appendix A.2, 
and the Performance Index for each user-infrastructure is summarized in Table III. 14. 

Infrastructure 


User 

Electric 

Natural Gas 

Water 

Building A 

0.02117 

0.00865 

0.01477 

Building B 

0.02901 

0.01505 

0.02117 

Building C 

0.06490 

0.01141 

0.00979 

Building D 

0.07274 

0.02117 

0.02117 

Building E 

0.02980 

0.00865 

0.02340 

Building F 

0.02980 

0.00865 

0.02340 

Table III. 14 Performance Index for user-infrastructure combination 


Once the PI is calculated for each user-infrastructure combination, the PI of each mcs 
is calculated as follows: 

MCS 

A:=l / j 

where 

Plmcsk is the performance index for minimal cut set mcsk 
MCS is the total number of mcs 

mcsijk is a Boolean operator (1 when the mcsA: impacts the 
user-infrastructure combination ij, and 0 otherwise) 

Plij is the performance index for the combination of user / and infrastructure j 
i is the user (1-6, for building A, B, C, D, E, F) 
j is the infrastructure (1 - 3, for electric, natural gas, water) 





For example, mcs (ea5, eal6) impacts electrical service to building A and building D, and no 
other user-infrastructure combinations. The Boolean operator mcsyk, for k representing the 
mcs (ea5, eal6), equals one when i equals 1 (electric) and j equals 1 (building A) or when i 
equals 1 (electric) and j equals 4 (building D), and zero in the remaining sixteen user- 
infrastructure combinations. So, the Plmcsk, where A: representing the mcs (ea5, eal6), equals 
the PI for electrical service to building A (0.02117) plus the PI for electrical service to 
building D (0.07274), which is 0.09391. This process is repeated for every mcs to assign a PI 
to each mcs, using Microsoft Excel®. The PI tabulations for each mcs are presented in 
Appendix A.3. Some of the mcs with the highest PI are shown in Table III. 15. 


PI 

Number 
of mcs 

mcs 

0.24742 

1 

(evl,ev2) 

0.15881 

47 

(ev23,ev6), (evl,ev5), (ea20,ev4), (eal9,ev2),.... 

0.11508 

1 

(ev8) 

0.11370 

3 

(wvl4), (wvl5), (wa20) 

0.09391 

48 

(ev21,ev6), (ev20,ev5), (eal7,ev2), (ev21,evl0),.... 

0.09030 

2 

(wvl6), (wal9) 

0.08861 

55 

(ev24,ev42), (ea40,ev42), (ea39,ev38), (evl,ev37),... 


Table III. 15 Performance Index values associated with minimal cut sets 


The list of mcs, ordered by PI, indicates which mcs, which if successfully attacked, 
would lead to the greatest disutility in the MIT community. The mcs (evl, ev2), because it 
carries the greatest PI, would cause the most significant impact. The ordered list suggests 
which mcs should be considered as critical locations, but the analysis is not complete, the 
vulnerability assessment must be completed to determine the actual critical locations. 

The PI for each mcs is the “value” portion of the vulnerability, so the susceptibility is 
analyzed following the guidelines established in section II.4.C. The susceptibility of each 
mcs is categorized in a level described by Table II.8. For example a successful attack against 
mcs (evl, ev2) requires an attack against evl and a separate attack against ev2. The 
susceptibility depends on the nature of the attack, for example the explosive range of a truck 














bomb is quite different from the explosive range of a suitcase bomb. The susceptibility of 
each must be analyzed and then combined to establish the susceptibility of mcs (evl, ev2). 

For example, if we assessed the susceptibility of evl to be high and the susceptibility of ev2 
to be low, we would assess the combined susceptibility (both evl and ev2) to be low. In 
general a mcs with multiple components would be no more susceptible than the most secure 
of the individual pieces, but could be less susceptible than the most secure piece when the 
combination of all components is considered. 

The threat for the particular example presented is a minor threat, which includes only a 
single point attack (i.e., an attack against one location.) Since a minor threat is not capable of 
a multi-axis attack, we may simplify the susceptibility analysis by classifying all mcs with 
two or more elements as zero susceptibility. We must consider this simplification carefully, 
however, as it is not appropriate for more advanced threats in which a coordinated multiple 
location attack must be considered. We assessed the susceptibility of each mcs using the 
classification levels presented in Table II.8, the complete susceptibility assessments, for the 
mcs with assessed to have susceptibility of very low or greater, are listed in Appendix A.4. 

Having established the value of each mcs (the PI) and the susceptibility, we combine 
the two using the guidelines established in Table II.9, to assign each mcs a vulnerability 
category. For example, looking at mcs wa20 we find it corresponds to the main water line 
serving the selected portion of campus. Failure of this line would result in loss of water 
service to all six users. The PI for mcs wa20 places it in the extreme value category. Since 
the water line is buried with no service access, it would be difficult to attack. As a result we 
classified the susceptibility of the water line as very low. Applying the guidelines in Table 
II.9, we intersect extreme value vwth very low susceptibility resulting in Blue vulnerability. 
The complete vulnerability categorizations are detailed in Appendix A.5, and summarized in 
Table III. 16. 

Through application of the infrastructure risk analysis model, we now have a 
prioritized list of mcs for consideration in risk management. The single mcs (ev8) Avith 
vulnerability red is dealt with first. We trace ev8 back to the network digraph and schematics 
to determine its identity. In this case, ev8 is identified as an electric service manhole in the 
selected portion of campus. The manhole has a specific identifier which uniquely identifies 





the location. In order to prevent the inadvertent release of the location, this manhole is 
referred to as EM-X by this analysis. Manhole EM-X contains the main electrical service 


Vulnerability 

Category 

Number 
of mcs 

mcs 

Red 

1 

(ev8) 

Orange 

0 

none 

Yellow 


(ev21), (ev22), (ev3), (ev34), (ev9) 

Blue 

19 

(wa20), (wvl4), (wvl5), (evl 1), (evl8), (evl9), 
(ev25), (gvl), (gv2), (gv3), (gv4), (gv5), (gv6), 

(wvl), (wv2), (wv3), (wv4), (wv5), (wv6) 

Green 

60 

(ealO), (eal8), (ea30), (gal 1), (gal9), (ga20), 

(gvl4), (gvl5), (gvl6), (gvl7), (gvl8), (wall), 

(wa8), (wvl 8), (wvl9), (wal9), (wvl6), (eal5), 
(ea38), (gal), (galO), (gal7), (gal8), (ga2), (ga21), 
(ga3), (ga4), (gaS), (ga6), (ga7), (ga8), (ga9), 

(gvlO), (gvl3), (gvl9), (gv20), (gv7), (gv8), (gv9), 
(wal), (walO), (wal3), (wal5), (wal7), (wal8), 
(wa2), (wa21), (wa3), (wa4), (wa5), (wa6), (wa7), 
(wa9), (wvl 1), (wvl2), (wvl 3), (wv20), (wv7), 
(wv8), (wv9) 


Table III. 16 Vulnerability Categories for the minimal cut sets 


switch to building D, so a successful attack against this manhole would interrupt electrical 
service to the building. Additionally, the natural gas and water service to building D also run 
through, or immediately adjacent to, manhole EM-X. A successful attack against this 
manhole would also interrupt the natural gas and water service to building D. A schematic of 
manhole EM-X is presented in Figure III. 11. The electric switches are designed to allow 
electricity flow in either direction (from EM-A to EM-X to EM-B, or from EM-B to EM-X to 
EM-A) and split the feed to provide electric service to building D. The natural gas and water 
service both come from their corresponding service network, via a building isolation valve, 
through the manhole to building D. This manhole shows a geographic vulnerability of 
multiple infrastructures which are not physically connected. None of the three services 







(electric, natural gas, or water) are connected to each other inside the manhole, yet all three 
are vulnerable to a single attack. 


Electric 

Manhole 

EM-B 


Building D 



Figure III.l 1 Electric Manhole EM-X 











III.6 Risk Management 

We now proceed to risk management of the vulnerabilities. The protection of the 
critical locations is accomplished by reducing the susceptibility of the location, reducing the 
value of the location, or some combination of the two. In reality the threats could be 
eliminated, but that is a law enforcement issue which is beyond the scope of this analysis. 
Many options for countermeasures are available and one must consider the options and the 
associated risks and benefits carefully. Potential actions are analyzed to support the selection 
of an appropriate countermeasure or combination of countermeasures. Each potential 
countermeasure is assessed against a set of common attributes to support comparison among 
the possibilities. We have chosen the set of attributes (security method, control method, cost, 
on-going cost, supply reliability, service quality) as shown in Figure III. 12. The number of 
attributes, and the attributes themselves, are chosen by the decision makers. Just as with the 
value tree, a different set of decision makers is likely to have different attributes, and we 
would have different attributes when addressing a different problem. 

From our example, the starting point is the red category (mcs ev8, manhole EM-X), 
which has the highest priority for countermeasure actions. Some possible countermeasures, 
not an exhaustive list, to address susceptibility and value of the critical location are shown in 
Table III. 17. We review the possible countermeasures to select the most appropriate for the 
situation, recognizing that taking no action is always a possibility which must be considered. 


Category 

Possible Countermeasures 

Reduce Susceptibility 

Weld the manhole cover 

Alarm the manhole cover 

Monitor the manhole cover 

Increase the security patrols 

Reduce Value 

Install additional independent infrastructure supply lines 
Install internal (to the building) back-up sources 


Table III. 17 Possible Countermeasures 





Analysis and 
Assessment 


Attributes 


/^ecurit)^ f Control 
\Method 


^Method 




For example, to review the possibility of welding the manhole cover to reduce the 
susceptibility we consider the attributes in Figure III. 12. The security method is a physical 
barrier (the weld) to access of the manhole. The access is controlled by cutting and re- 
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welding the cover as required. Cutting the weld would require tools and sufficient time. Our 
assessment is that welding the cover would reduce the susceptibility from high to low. There 
is no change in the value of the location; the supply reliability and service quality remain 
unchanged. The cost of welding is low; as is the on-going cost (the manhole is not routinely 
accessed.) The new vulnerability category for manhole EM-X (mcs ev8) is Yellow (low 
susceptibility and extreme value.) 

To look at the value portion of the equation, we consider the installation of additional 
infrastructure service to the affected user (building D.) Additional services are considered for 
each of the infrastructures. The PI for building D, for all three services, is 0.11508, as 
presented in Appendix A.3. The electric service accounts for 63 percent of that value, or 
0.07274, with water and gas accounting for the rest. Installing an additional electrical feed to 
the building would reduce the PI of the manhole to 0.04234 (low). Considering only the 
additional electrical service the new vulnerability category for manhole EM-X (mcs ev8) is 
Yellow (high susceptibility and low value.) The costs of installing and maintaining the 
service is significant and must be considered. 

If we choose to take both steps, installing the additional electrical service eind welding 
the manhole cover, the new vulnerability category for manhole EM-X (mcs ev8) would be 
Green (low susceptibility and low value.) Once a countermeasure is selected, the analysis is 
repeated taking into account the impact of the countermeasure. The decision maker should 
review the entire process to ensure there are no unintended consequences of the 
countermeasure. Once satisfied, the decision maker would move to the next vulnerability. In 
the event that no countermeasure is chosen, the decision maker just proceeds to the next 
vulnerability. In this example, there are no mcs categorized as Orange, so the decision 
makers proceed to the Yellow category. The process repeats imtil the decision maker feels 
satisfied in the risk management efforts. Continuous assessment ensures the commimity risk 
profile is reviewed on a regular basis. 
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IV. Comments 

The analysis of the MIT community served to validate the screening methodology for 
the identification of critical locations in infrastructures. We gained significant insight into the 
infrastructure system through the development of the network digraphs. In the case where the 
decision makers are interested solely in the number of user-infrastructure combinations 
impacted by each location, the network models provide that information without further 
analysis. However, this approach would ignore the vulnerability portion of the analysis. By 
excluding the vulnerability assessment, the analyst could remove the human judgment from 
the prioritization. In effect, the decision maker would be presented with a list of infrastructure 
locations ordered by the number of user-infrastructure combinations they impact. To develop 
a more realistic prioritization of the locations the vulnerability must be included in the 
analysis. The treatment of uncertainties and expert judgment become important in this 
process. The threat assessment is limited in that terrorist risk assessment studies are generally 
classified. [Garrick, 2002] This study worked with fixed threat parameters and the 
uncertainties were incorporated through expert judgment at the performance measure level. 
This methodology is a screening methodology to identify the candidate critical locations. 
These locations are subjected to a review panel and the critical locations are identified 
through expert judgment. Another way of looking at it is that we have developed a 
methodology for initial screening and identification of critical locations. A rigorous 
uncertainty analysis, including organizational response, would be done for these critical 
locations. 

The MIT case study revealed some issues with regard to the screening of critical 
locations in infrastructures and infrastructure analysis. The availability of infrastructure 
documentation cannot be overlooked. The MIT study had the benefit of full, unrestricted 
access to the infrastructure design, layout, location, and operating instructions. In expanding 
the analysis beyond the confines of MIT, it is anticipated that obtaining infrastructure 
documentation will be challenging. The data mining task itself could prove complicated, as 
the data must be gathered from multiple utilities and various governmental agencies. It is 
recognized that commercial data may be proprietary and governmental data may be classified. 
Also, the issue of data completeness must be faced. Even if the analyst had full access to the 
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industry and government data there is a concern the information may not be complete. 

During some of the older construction of utility infrastructures good records were not kept 
concerning the location of lines. Data accuracy must also be addressed, for it is not certain 
that accurate records exist concerning growth and changes. Unauthorized modifications may 
exist and authorized modifications may not be properly documented. 

Another issue which must be considered by the analyst is the impact of isolation for 
the damaged portion of the networks. For example, consider again the sample water 
distribution network reviewed in Figure II.5. If a successful attack were conducted against v5, 
the analyst could immediately determine that water would be denied to user B. The impact on 
user A requires a more detailed review. The likely upstream isolation point for the damage at 
v5 is the next upstream valve; in this case assume that valve to be v2, see Figure IV. 1. While 



Figure IV. 1 Water distribution network with damage and isolation 


the damage to v5 is the direct cause of the loss of water suffered by user B, the isolation 
required is the cause of the loss of water to user A. The loss of water to the users may be of 
different durations. The restoration to user B may require replacement of valve v5 and repair 
of the associated water pipes, which may be moderate in duration. Water pipe a4 may be 
temporarily capped to provide isolation, so the valve v2 maybe reopened to restore service to 
user A; which could be minor in duration. The analyst must take care to ensure the true 
impact of potential attacks is included in the analysis. 

The MIT campus contains sufficient infrastructure components that it provides a good 
prototype. MIT operates a utility plant, utilities distribution network, data network, cable 










television station, and phone system, and has its own police and medical personnel. The MIT 
campus contains a Critical Infrastructure, the Central Utilities Plant, and a Key Asset, the 
Nuclear Research Reactor. The Reactor does not use natural gas, so there would be no impact 
in the event of an interruption of natural gas service. Sufficient water inventory is maintained 
within the reactor complex to withstand a water outage of significant duration. The loss of 
electrical service would possibly be an impact. The Reactor Operations team has sufficiently 
analyzed the impact of loss of the electrical service, and no additional risks are anticipated 
from the infrastructure analysis. 

Several drawbacks were vmcovered. First, there are very limited physical 
dependencies between the infrastructures on the MIT campus. The natural gas fired electric 
generation turbine and electric driven domestic water pumps account for most of the 
infrastructure ties. There is no water pumping stations or natural gas pressurization points on 
the campus. Second, the campus could be viewed as homogeneous with regard to mission; 
MIT is primarily a research institution. This eased our determination of the disutility on the 
users. In expanding the scope to model a city, for example, the decision makers may have 
more difficulty comparing disutility across society. Political influence, which was not 
experienced in the MIT study, may become a factor. Finally, the impact of a loss of one or 
multiple infrastructures on law enforcement and firefighting was not included in the MIT 
prototype. Faced with a significant electric power or water outage society must address the 
issue of rioting and looting. Those objectives may influence the decision. 

The issues of outages and maintenance, both preventative and corrective, were not 
included in the analysis. Clearly, the unavailability of certain components could impact the 
prioritization index. To gain additional accuracy the unavailability periods should be 
included. 

The screening methodology may be expanded beyond MIT to a smaller scale (larger 
area). The decision makers will make an assessment of the level of detail to be analyzed, 
which will impact the complexity of the model. Trying to model every building in the nation, 
or even the state, would likely prove exhausting. At the city level the decision makers may 
decide, for a first look, to represent each neighborhood as a vertex and model the ties between 
the cities with arcs. The second level analysis could look deeper into each neighborhood. On 
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a national level the decision makers may, for example, choose to look at the interstate 
transmission voltage network for electricity. By focusing on a specific voltage the decision 
makers should be able to bound the problem. Another approach could be to identify the 
critical facilities in a region like hospitals, emergency response units, water pumping stations, 
electrical generation (and distribution substations), etc. Then model their infrastructure 
supplies using the network digraphs. The methodology could then be used to identify the 
critical locations in the infrastructures serving the identified facilities. 




V. Conclusions 

This project presents a screening methodology to analyze infrastructures to identify 
the critical locations. The methodology itself is a general approach which may be used in a 
number of prioritization situations. The general portions include the development and 
application of the value tree, constructed scales, and the AHP to assign weights to the 
objectives and performance measures. These techniques are commonly applied in decision 
analysis. The infrasthictures are “valued” through application of this general approach. The 
details of the process reviewed in this project apply only to the specific decision considered 
for the specific decision makers. A different set of decision makers, applying the 
methodology to the same problem, may arrive at a different ending. However, using such an 
explicit methodology may help the disagreeing parties to reach consensus, because their 
disagreements will be specific. And, the same decision makers using the process to prioritize 
a different problem would achieve different results. The methodology makes use of a 
quantitative approach which supports a specific numerical comparison of the effects of 
different threats and different targets. 

The portion of the methodology specific to the MIT campus infrastructures is the 
modeling of the infrastructures as interconnected digraphs and accompanying application of 
graph theory and reliability theory to identify the vulnerable points, modeled as minimal cut 
sets. A mcs may be impact more than one user and/or more than one infrastructure. Once all 
the users have been examined, a database is compiled of the mcs, with the associated PI 
representing the “value” of the mcs to the infrastructure. The susceptibility of each mcs is 
assessed and combined with the value of the mcs to produce a vulnerability assessment of the 
mcs. A prioritized list of mcs for consideration is developed. 
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Appendix A.l Minimal Cut Sets by Infrastructure and User 

Minimal Cut Sets - Natural Gas 
Bldg E (vertex gv5) 


{(gvl4), 

(ga20), 

(gvl 5), 

(gal 8), 

(gvl 3), 

(gal7). 

(gv5)} 






Bldg C (vertex gv3) 





{(gvl4). 

(ga20), 

(gvl 5), 

(gal9), 

(gvl 6), 

(gvl7). 

(gall), 

(gvl 8), 

(ga8). 

(gvl 9), 

(ga5). 

(gv20), 

(ga6), 

(gv7). 

(ga7), 

(gv3), 

(gal 2,gal 5), 

(gal2,gvl2). 

(gal 2,gal 6), 

(gal2,gv6), 

(gal2,ga22), 

(gal2,ev3), 

(gal 2,gal 4), 

(gal2,gvll), 

(gal 2,gal3)} 






Bldg B (vertex gv2) 





{(gvl4), 

(ga20), 

(gvl 5), 

(gal9), 

(gvl 6), 

(gvl 7), 

(gall), 

(gvl8). 

(ga8). 

(gvl 9), 

(ga5). 

(gv20), 

(ga4), 

(gv8), 

(ga3), 

(gv2), 

(gal2,gal5). 

(gal2,gvl2), 

(gal 2,gal 6), 

(gal2,gv6). 

(gal2,ga22), 

(gal2,ev3), 

(gal2,gal4), 

(gal2,gvll), 

(gal2,gal3)} 






Bldg A (vertex gvl) 





{(gvl4). 

(ga20). 

(gvl 5), 

(gal9), 

(gvl 6), 

(gvl 7), 

(gall). 

(gvl 8), 

ia8), 

(gvl 9), 

(ga2). 

(gv9). 

(gal). 

(gvl). 

(gal 2,gal 5), 

(gal2,gvl2), 

(gal 2,gal 6), 

(gal2,gv6), 

(gal2,ga22). 

(gal2,ev3), 

(gal 2,gal 4), 

(gal2,gvll), 

(gal2,gal3)} 


Bldg D (vertex gv4) 





{(gvl4). 

(ga20), 

(gvl 5), 

(gal9). 

(gvl 6), 

(gvl7), 

(gall). 

(gvl 8), 

(galO), 

(gvlO), 

(ga9), 

(ev8). 

(ga21). 

(gv4), 

(gal 2,gal 5), 

(gal2,gvl2), 

(gal 2,gal 6), 

(gal2,gv6), 

(gal2,ga22), 

(gal2,ev3), 

(gal2,gal4), 

(gal 2,gv 11), 

(gal 2,gal3)} 


Bldg F (vertex gv6) 





{(gvl4). 

(ga20). 

(gvl 5), 

(gal9), 

(gvl 6), 

(gv6), 

(gal 5,gal 2), 

(gal5,gvl7). 

(gal 5,gal 3), 

(gal 5,gvl 1), 

(gal5,gal4), 

(gal5,ev3), 

(gal5,ga22), 

(gvl2,gal2). 

(gvl2,gvl7), 

(gvl2,gal3). 

(gvl 2,gvl 1), 

(gvl2,gal4). 

(gvl2,ev3), 

(gvl2,ga22), 

(gal 6,gal 2), 

(gal 6,gvl 7), 

(gal 6,gal 3), 

(gal 6,gvl 1), 

(gal 6,gal 4), 

(gal6,ev3), 

(gal6,ga22)} 







Minimal Cut Sets — Water 


Bldg F (vertex wv6') 

{(wvl4), (wa20), (wvl5), (wal5), (wvl2), (wv6), 

(wal4,wal2), (wal4,wvl7), (wal4,wal6), (wvl0,wal2), (wvl0,wvl7), (Awl0,wal6), 

(wa22,wal2), (wa22,wvl7), (wa22,wal6)} 


Bldg E ("vertex wv5') 


{(wvl4X 

(wa20), 

(wvl 5), 

(wvl8), 

(walO), 

(wvl 3), 

Bldg D (vertex wv4) 


{(wvl4). 

(wa20). 

(wvl 5), 

(wvll), 

(wa21), 

(ev8), 

Bldg A (vertex wvl) 


{(wvl4). 

(wa20), 

(wvl 5), 

(wvl8), 

(wvl)} 

(wa8), 

(wvl 9), 

Bldg C (vertex wv3) 


{(wvl4). 

(wa20), 

(wvl 5), 

(wvl 8), 

(wa8), 

(wvl 9), 

(wv7). 

(wa7), 

(wv3)} 

Bldg B (vertex wv2) 


{(wvl4). 

(wa20), 

(wvl 5), 

(wvl 8), 

(wa8). 

(wvl 9), 

(wv8), 

(wa3X 

(evl 1), 


(wal9), 

(wal7). 

(wvl 6), 
(wv5)} 

(wall), 

(wal9), 

(wal3). 

(wvl 6), 
(wv4)} 

(wa9). 

(wal9), 

(wa2). 

(wvl 6), 
(wv9), 

(wall), 

(wal). 

(wal9), 

(wa5). 

(wvl 6), 
(wv20), 

(wall), 

(wa6). 

(wal9), 

(wa5), 

(wal8). 

(wvl 6), 
(wv20), 
(wv2)} 

(wall), 

(wa4). 



# 





Minimal Cut Sets - Electric 


Bldg C (vertex ev22') 


{(ev22), 

(eal9,evl8), 

(eal9,evl4), 

(eal9,ev6), 

(eal9,evl3), 


(eal8), 

(eal9,eal4), 

(eal9,ea9), 

(eal9,ea5), 

(eal9,eal), 


(ev23,evl 8), (ev23,eal 4), 
(ev23,evl4), (ev23,ea9), 
(ev23,ev6), (ev23,ea5), 

(ev23,evl3), (ev23,eal), 


(ea20,evl 8), 

(ea20,evl4), 

(ea20,ev6), 

(ea20,evl3), 

(evl,evl8), 

(evl,evl4), 

(evl,ev6), 

(evl,evl3), 


(ea20,eal4), 

(ea20,ea9), 

(ea20,ea5), 

(ea20,eal), 

(evl,eal4), 

(evl,ea9), 

(evl,ea5), 

(evl,eal), 


Bldg B (vertex ev25> 
{(ev25), (ea38), 

(ev24,ev27), (ev24,ea34), 
(ev24,ev32), (ev24,ea29), 
(ev24,ev36), (ev24,ea25), 
(ev24,ev40), (ev24,ea41), 
(ea39,ev26), (ea39,ea36), 
(ea39,ev30), (ea39,ea32), 
(ea39,ev35), (ea39,ea27), 
(ea39,ev38), (ea39,ea22), 
(ea39,ev2), (ea40,ea37), 

(ea40,ev29), (ea40,ea33), 
(ea40,ev3), (ea40,ea28), 

(ea40,ev37), (ea40,ea23), 
(ea40,ev42), (ea40,ea42), 
(ev 1 ,ev27), (ev 1 ,ea34), 
(evl,ev32), (evl,ea29), 

(evl,ev36), (evl,ea25), 

(ev 1 ,ev40), (ev 1 ,ea41), 


(ev21), 

(eal9,evl7), 

(eal9,ev8), 

(eal9,ev5), 

(eal9,ev2), 

(ev23,evl7), 

(ev23,ev8), 

(ev23,ev5), 

(ev23,ev2), 

(ea20,evl7), 

(ea20,ev8), 

(ea20,ev5), 

(ea20,ev2), 

(evl,evl7), 

(evl,ev8), 

(evl,ev5), 

(evl,ev2)} 


(evl 1), 

(ev24,ev29), 

(ev24,ev3), 

(ev24,ev37), 

(ev24,ev42), 

(ea39,ev27), 

(ea39,ev32), 

(ea39,ev36), 

(ea39,ev40), 

(ea40,ev26), 

(ea40,ev30), 

(ea40,ev35), 

(ea40,ev38), 

(ea40,ev2), 

(evl,ev29), 

(evl,ev3), 

(evl,ev37), 

(evl,ev42), 


(eal9,eal7), 

(eal9,eal3), 

(eal9,ea8), 

(eal9,ea3), 

(ev23,eal7), 

(ev23,eal3), 

(ev23,ea8), 

(ev23,ea3), 

(ea20,eal7), 

(ea20,eal3), 

(ea20,ea8), 

(ea20,ea3), 

(evl,eal7), 

(evl,eal3), 

(evl,ea8), 

(evl,ea3i 


(ev24,ea37), 

(ev24,ea33), 

(ev24,ea28), 

(ev24,ea23), 

(ev24,ea42), 

(ea39,ea34), 

(ea39,ea29), 

(ea39,ea25), 

(ea39,ea41), 

(ea40,ea36), 

(ea40,ea32), 

(ea40,ea27), 

(ea40,ea22), 

(evl,ea37), 

(evl,ea33), 

(evl,ea28), 

(evl,ea23), 

(evl,ea42), 


(eal9,ev20), 

(eal9,evl5), 

(eal9,evl0), 

(eal9,ev4), 

(ev23,ev20), 

(ev23,evl5), 

(ev23,evl 0), 

(ev23,ev4), 

(ea20,ev20), 

(ea20,evl5), 

(ea20,evl0), 

(ea20,ev4), 

(evl,ev20), 

(evl,evl 5), 

(evl,evl0), 

(evl,ev4), 


(ev24,ev26), 

(ev24,ev30), 

(ev24,ev35), 

(ev24,ev38), 

(ev24,ev2), 

(ea39,ev29), 

(ea39,ev3), 

(ea39,ev37), 

(ea39,ev42), 

(ea40,ev27), 

(ea40,ev32), 

(ea40,ev36), 

(ea40,ev40), 

(evl,ev26), 

(evl,ev30), 

(evl,ev35), 

(evl,ev38), 

(evl,ev2)} 


(eal9,eal6), 

(eal9,eal2), 

(eal9,ea7), 

(eal9,ea2), 

(ev23,eal6), 

(ev23,eal2), 

(ev23,ea7), 

(ev23,ea2), 

(ea20,eal6), 

(ea20,eal2), 

(ea20,ea7), 

(ea20,ea2), 

(evl,eal6), 

(evl,eal2), 

(evl,ea7), 

(evl,ea2), 


(ev24,ea36), 

(ev24,ea32), 

(ev24,ea27), 

(ev24,ea22), 

(ea39,ea37), 

(ea39,ea33), 

(ea39,ea28), 

(ea39,ea23), 

(ea39,ea42), 

(ea40,ea34), 

(ea40,ea29), 

(ea40,ea25), 

(ea40,ea41), 

(evl,ea36), 

(evl,ea32), 

(evl,ea27), 

(evl,ea22). 
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Bldg A Tvertex evl9~) 

{(evl9), (eal5), (evl8), (eal9,eal4), 

(eal9,evl5), (eal9,eal2), (eal9,evl4), (eal9,ea9), 
(eal9,evl0), (eal9,ea7), (eal9,ev6), (eal9,ea5), 

(eal9,ev4), (eal9,ea2), (eal9,evl3), (eal9,eal), 

(ev23,evl7), (ev23,eal3), (ev23,evl5), (ev23,eal2), 
(ev23,ev8), (ev23,ea8), (ev23,evl0), (ev23,ea7), 

(ev23,ev5), (ev23,ea3), (ev23,ev4), (ev23,ea2), 

(ev23,ev2), (ea20,eal4), (ea20,evl7), (ea20,eal3), 

(ea20,evl4), (ea20,ea9), (ea20,ev8), (ea20,ea8), 

(ea20,ev6), (ea20,ea5), (ea20,ev5), (ea20,ea3), 

(ea20,evl3), (ea20,eal), (ea20,ev2), (evl,eal4), 

(evl,evl5), (evl,eal2), (evl,evl4), (evl,ea9), 
(evl,evlO), (evl,ea7), (evl,ev6), (evl,ea5), 
(evl,ev4), (evl,ea2), (evl,evl3), (evl,eal), 
(eal7,evl7), (eal7,eal3), (eal7,evl5), (eal7,eal2), 
(eal7,ev8), (eal7,ea8), (eal7,evl0), (eal7,ea7), 

(eal7,ev5), (eal7,ea3), (eal7,ev4), (eal7,ea2), 

(eal7,ev2), (ev20,eal4), (ev20,evl7), (ev20,eal3), 

(ev20,evl4), (ev20,ea9), (ev20,ev8), (ev20,ea8), 

(ev20,ev6), (ev20,ea5), (ev20,ev5), (ev20,ea3), 

(ev20,evl3), (ev20,eal), (ev20,ev2), (eal6,eal4), 

(eal6,evl5), (eal6,eal2), (eal6,evl4), (eal6,ea9), 
(eal6,evl0), (eal6,ea7), (eal6,ev6), (eal6,ea5), 

(eal6,ev4), (eal6,ea2), (eal6,evl3), (eal6,eal), 

(ev21,evl7), (ev21,eal3), (ev21,evl5), (ev21,eal2), 
(ev21,ev8), (ev21,ea8), (ev21,evl0), (ev21,ea7), 

(ev21,ev5), (ev21,ea3), (ev21,ev4), (ev21,ea2), 

(ev21,ev2)} 


(eal9,evl7), 

(eal9,ev8), 

(eal9,ev5), 

(eal9,ev2), 

(ev23,evl4), 

(ev23,ev6), 

(ev23,evl3), 

(ea20,evl5), 

(ea20,evl0), 

(ea20,ev4), 

(evl,evl7), 

(evl,ev8), 

(evl,ev5), 

(evl,ev2), 

(eal7,evl4), 

(eal7,ev6), 

(eal7,evl3), 

(ev20,evl5), 

(ev20,evl0), 

(ev20,ev4), 

(eal6,evl7), 

(eal6,ev8), 

(eal6,ev5), 

(eal6,ev2), 

(ev21,evl4), 

(ev21,ev6), 

(ev21,evl3). 


(eal9,eal3), 

(eal9,ea8), 

(eal9,ea3), 

(ev23,eal4), 

(ev23,ea9), 

(ev23,ea5), 

(ev23,eal), 

(ea20,eal2), 

(ea20,ea7), 

(ea20,ea2), 

(evl,eal3), 

(evl,ea8), 

(evl,ea3), 

(eal7,eal4), 

(eal7,ea9), 

(eal7,ea5), 

(eal7,eal), 

(ev20,eal2), 

(ev20,ea7), 

(ev20,ea2), 

(eal6,eal3), 

(eal6,ea8), 

(eal6,ea3), 

(ev21,eal4), 

(ev21,ea9), 

(ev21,ea5), 

(ev21,eal), 
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Bldg D (vertex ev9) 
{(ev9), (ealO), 

(eal9,ev6), (eal9,ea5), 

(eal9,evl3), (eal9,eal), 
(ev23,ev6), (ev23,ea5), 

(ev23,evl3), (ev23,eal), 
(ea20,ev6), (ea20,ea5), 

(ea20,evl3), (ea20,eal), 
(evl,ev6), (evl,ea5), 
(evl,evl3), (evl,eal), 
(eal7,ev6), (eal7,ea5), 

(eal7,evl3), (eal7,eal), 
(ev20,ev6), (ev20,ea5), 

(ev20,evl3), (ev20,eal), 
(eal6,ev6), (eal6,ea5), 

(eal6,evl3), (eal6,eal), 
(ev21,ev6), (ev21,ea5), 

(ev21,evl3), (ev21,eal), 
(eal4,ev6), (eal4,ea5), 

(eal4,evl3), (eal4,eal), 
(evl7,ev6), (evl7,ea5), 

(evl7,evl3), (evl7,eal), 
(eal3,ev6), (eal3,ea5), 

(eal3,evl3), (eal3,eal), 
(evl5,ev6), (evl5,ea5), 

(evl5,evl3), (evl5,eal), 
(eal2,ev6), (eal2,ea5), 

(eal2,evl3), (eal2,eal), 
(evl4,ev6), (evl4,ea5), 

(evl4,evl3), (evl4,eal), 
(ea9,ev6), (ea9,ea5), 

(ea9,evl3), (ea9,eal), 
(evl8,ev6), (evl8,ea5), 

(evl8,evl3), (evl8,eal), 


(ev8), 

(eal9,ev5), 

(eal9,ev2), 

(ev23,ev5), 

(ev23,ev2), 

(ea20,ev5), 

(ea20,ev2), 

(evl,ev5), 

(evl,ev2), 

(eal7,ev5), 

(eal7,ev2), 

(ev20,ev5), 

(ev20,ev2), 

(eal6,ev5), 

(eal6,ev2), 

(ev21,ev5), 

(ev21,ev2), 

(eal4,ev5), 

(eal4,ev2), 

(evl7,ev5), 

(evl7,ev2), 

(eal3,ev5), 

(eal3,ev2), 

(evl5,ev5), 

(evl5,ev2), 

(eal2,ev5), 

(eal2,ev2), 

(evl4,ev5), 

(evl4,ev2), 

(ea9,ev5), 

(ea9,ev2), 

(evl8,ev5), 

(evl8,ev2)} 


(eal9,ea8), 

(eal9,ea3), 

(ev23,ea8), 

(ev23,ea3), 

(ea20,ea8), 

(ea20,ea3), 

(evl,ea8), 

(evl,ea3), 

(eal7,ea8), 

(eal7,ea3), 

(ev20,ea8), 

(ev20,ea3), 

(eal6,ea8), 

(eal6,ea3), 

(ev21,ea8), 

(ev21,ea3), 

(eal4,ea8), 

(eal4,ea3), 

(evl7,ea8), 

(evl7,ea3), 

(eal3,ea8), 

(eal3,ea3), 

(evl5,ea8), 

(evl5,ea3), 

(eal2,ea8), 

(eal2,ea3), 

(evl4,ea8), 

(evl4,ea3), 

(ea9,ea8), 

(ea9,ea3), 

(evl8,ea8), 

(evl8,ea3), 


(eal9,evl0), 

(eal9,ev4), 

(ev23,evl0), 

(ev23,ev4), 

(ea20,evl0), 

(ea20,ev4), 

(evl,evlO), 

(evl,ev4), 

(eal7,evl0), 

(eal7,ev4), 

(ev20,evl0), 

(ev20,ev4), 

(eal6,evl0), 

(eal6,ev4), 

(ev21,evl0), 

(ev21,ev4), 

(eal4,evl0), 

(eal4,ev4), 

(evl7,evl0), 

(evl7,ev4), 

(eal3,evlO), 

(eal3,ev4), 

(evl5,evlO), 

(evl5,ev4), 

(eal2,evl0), 

(eal2,ev4), 

(evl4,evl0), 

(evl4,ev4), 

(ea9,evl0), 

(ea9,ev4), 

(evl8,evlO), 

(evl8,ev4), 


(eal9,ea7), 

(eal9,ea2), 

(ev23,ea7), 

(ev23,ea2), 

(ea20,ea7), 

(ea20,ea2), 

(evl,ea7), 

(evl,ea2), 

(eal7,ea7), 

(eal7,ea2), 

(ev20,ea7), 

(ev20,ea2), 

(eal6,ea7), 

(eal6,ea2), 

(ev21,ea7), 

(ev21,ea2), 

(eal4,ea7), 

(eal4,ea2), 

(evl7,ea7), 

(evl7,ea2), 

(eal3,ea7), 

(eal3,ea2), 

(evl5,ea7), 

(evl5,ea2), 

(eal2,ea7), 

(eal2,ea2), 

(evl4,ea7), 

(evl4,ea2), 

(ea9,ea7), 

(ea9,ea2), 

(evl8,ea7), 

(evl8,ea2). 
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Bldg E. F Cvertex ev34') 
{(ev34), (ea30), 

(ea40,ev36), (ea40,ea25), 
(ea40,ev40), (ea40,ea41), 
(evl,ev35), (evl,ea27), 

(evl,ev38), (evl,ea22), 

(evl,ev2), (ev24,ea28), 

(ev24,ev37), (ev24,ea23), 
(ev24,ev42), (ev24,ea42), 
(ea39,ev36), (ea39,ea25), 
(ea39,ev40), (ea39,ea41), 
(evll,ev35), (evll,ea27), 
(ev 11 ,ev3 8), (ev 11 ,ea22), 
(ev 11 ,ev2), (ea3 7,ea2 8), 

(ea37,ev37), (ea37,ea23), 
(ea37,ev42), (ea37,ea42), 
(ev26,ev36), (ev26,ea25), 
(ev26,ev40), (ev26,ea41), 
(ea36,ev35), (ea36,ea27), 
(ea36,ev38), (ea36,ea22), 

(ea36,ev2), (ev27,ea28), 

(ev27,ev37), (ev27,ea23), 
(ev27,ev42), (ev27,ea42), 
(ea34,ev36), (ea34,ea25), 
(ea34,ev40), (ea34,ea41), 
(ev29,ev35), (ev29,ea27), 
(ev29,ev38), (ev29,ea22), 
(ev29,ev2), (ea33,ea28), 

(ea33,ev37), (ea33,ea23), 
(ea33,ev42), (ea33,ea42), 

(ev30,ev36), (ev30,ea25), 
(ev30,ev40), (ev30,ea41), 
(ea32,ev35), (ea32,ea27), 
(ea32,ev38), (ea32,ea22), 

(ea32,ev2), (ev32,ea28), 

(ev32,ev37), (ev32,ea23), 
(ev32,ev42), (ev32,ea42), 
(ea29,ev36), (ea29,ea25), 
(ea29,ev40), (ea29,ea41), 


(ev3), 

(ea40,ev37), 

(ea40,ev42), 

(evl,ev36), 

(evl,ev40), 

(ev24,ev35), 

(ev24,ev38), 

(ev24,ev2), 

(ea39,ev37), 

(ea39,ev42), 

(evll,ev36), 

(evll,ev40), 

(ea37,ev35), 

(ea37,ev38), 

(ea37,ev2), 

(ev26,ev37), 

(ev26,ev42), 

(ea36,ev36), 

(ea36,ev40), 

(ev27,ev35), 

(ev27,ev38), 

(ev27,ev2), 

(ea34,ev37), 

(ea34,ev42), 

(ev29,ev36), 

(ev29,ev40), 

(ea33,ev35), 

(ea33,ev38), 

(ea33,ev2), 

(ev30,ev37), 

(ev30,ev42), 

(ea32,ev36), 

(ea32,ev40), 

(ev32,ev35), 

(ev32,ev38), 

(ev32,ev2), 

(ea29,ev37), 

(ea29,ev42), 


(ea40,ea28), 

(ea40,ea23), 

(ea40,ea42), 

(evl,ea25), 

(evl,ea41), 

(ev24,ea27), 

(ev24,ea22), 

(ea39,ea28), 

(ea39,ea23), 

(ea39,ea42), 

(evll,ea25), 

(evll,ea41), 

(ea37,ea27), 

(ea37,ea22), 

(ev26,ea28), 

(ev26,ea23), 

(ev26,ea42), 

(ea36,ea25), 

(ea36,ea41), 

(ev27,ea27), 

(ev27,ea22), 

(ea34,ea28), 

(ea34,ea23), 

(ea34,ea42), 

(ev29,ea25), 

(ev29,ea41), 

(ea33,ea27), 

(ea33,ea22), 

(ev30,ea28), 

(ev30,ea23), 

(ev30,ea42), 

(ea32,ea25), 

(ea32,ea41), 

(ev32,ea27), 

(ev32,ea22), 

(ea29,ea28), 

(ea29,ea23), 

(ea29,ea42). 


(ea40,ev35), 

(ea40,ev38), 

(ea40,ev2), 

(evl,ev37), 

(evl,ev42), 

(ev24,ev36), 

(ev24,ev40), 

(ea39,ev35), 

(ea39,ev38), 

(ea39,ev2), 

(evll,ev37), 

(evl l,ev42), 

(ea37,ev36), 

(ea37,ev40), 

(ev26,ev35), 

(ev26,ev38), 

(ev26,ev2), 

(ea36,ev37), 

(ea36,ev42), 

(ev27,ev36), 

(ev27,ev40), 

(ea34,ev35), 

(ea34,ev38), 

(ea34,ev2), 

(ev29,ev37), 

(ev29,ev42), 

(ea33,ev36), 

(ea33,ev40), 

(ev30,ev35), 

(ev30,ev38), 

(ev30,ev2), 

(ea32,ev37), 

(ea32,ev42), 

(ev32,ev36), 

(ev32,ev40), 

(ea29,ev35), 

(ea29,ev38), 

(ea29,ev2)} 


(ea40,ea27), 

(ea40,ea22), 

(evl,ea28), 

(evl,ea23), 

(evl,ea42), 

(ev24,ea25), 

(ev24,ea41), 

(ea39,ea27), 

(ea39,ea22), 

(evll,ea28), 

(evll,ea23), 

(evl l,ea42), 

(ea37,ea25), 

(ea37,ea41), 

(ev26,ea27), 

(ev26,ea22), 

(ea36,ea28), 

(ea36,ea23), 

(ea36,ea42), 

(ev27,ea25), 

(ev27,ea41), 

(ea34,ea27), 

(ea34,ea22), 

(ev29,ea28), 

(ev29,ea23), 

(ev29,ea42), 

(ea33,ea25), 

(ea33,ea41), 

(ev30,ea27), 

(ev30,ea22), 

(ea32,ea28), 

(ea32,ea23), 

(ea32,ea42), 

(ev32,ea25), 

(ev32,ea41), 

(ea29,ea27), 

(ea29,ea22), 
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Appendix A.2 Performance Index (PI) calculation for each 
user-infrastructure combination 

This appendix presents the constructed scales used by the decision maker to assess the 
disutility for each user-infrastructure combination. The global weight is contained along side 
each constructed scale for reference. The scales are presented in user order (building A, 
building B, ...building F). The decision makers’ analysis of the appropriate level on the 
constructed scale, for the specific threat, is annotated with a 1 in the row indicating the 
constructed scale level under the appropriate infrastructure column. The columns are 
designated E for electrical service, NG for natural gas service, and W for water service. 

When the decision maker has completed the analysis each constructed scale will contain three 
1 entries, one for each infrastructure. A summary of the final PI entries is: 

Infrastructure 


User 

Electric 

Natural Gas 

Water 

Building A 

0.02117 

0.00865 

0.01477 

Building B 

0.02901 

0.01505 

0.02117 

Building C 

0.06490 

0.01141 

0.00979 

Building D 

0.07274 

0.02117 

0.02117 

Building E 

0.02980 

0.00865 

0.02340 

Building F 

0.02980 

0.00865 

0.02340 
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Building A 

E NG W 


Impact on People 



Level 

Description 

Disutility 

wt 

3 

Fatility or Leathal exposure 

1.00 

0.295 


roof collapse, falling brick, gas inhalation 



2 

Major exposure with long-term effects 
lead poisoning 

0.46 


1 

Minor injury or exposure 
broken arm, laceration 

0.05 


0 

No personal injury 

0.00 



Disutility (Impact on People) 


Impact on 

the Environmental 

Level Description 

Disutility 

Weight 

0.196 

3 

Major environmental impact 

1.00 


2 

Moderate environmental impact 

0.34 


1 

Minor environmental impact 

0.04 


0 

No environmental impact 

0.00 



Disutility (Impact on the Environment) 


Interruption of Academic Activities and Operations 

Level Description 

Disutility 

Weight 

0.056 

4 

Extreme interruption 
greater than 6 months, entire buildings 

LOO 


3 

Major interruption 

1 to 6 months, laboratories 

0.57 


2 

Moderate interruption 

1 to 4 weeks, specialty classrooms 

0.19 


1 

Minor interruption 

less than 1 week, admin units, small class 

0.06 


0 

No interruption 

0.00 



Disutility (Interruption of Activities & Operations) 

Programs Affected 

Level Description 

Disutility 

Weight 

0.138 

4 

Extreme impact 
> $20M and/or 250 students 

1.00 


3 

Major impact 

$10M to $20M and/or 50 to 250 students 

0.50 


2 

Moderate impact 

$1M to $10M and/or 5 to 50 students 

0.23 


1 

Minor impact 

up to $1M and/or 5 students 

0.02 


0 

No impact 

0.00 


0 

0 

0 

0 

0 

0 

0 

0 

0 

1 

1 

1 

0.0000 

0.0000 

0.00001 

E 

NG 

w 

0 

0 

0 

0 

0 

0 

0 

0 

0 

1 

1 

1 

0.0000 

0.0000 

0.0000 

E 

NG 

w 

0 

0 

0 

0 

0 

0 

0 

0 

0 

1 

0 

1 

0 

1 

0 

0.0034 

0.0000 

0.0034 

E 

NG 

w 

0 

0 

0 

0 

0 

0 

0 

0 

0 

1 

0 

1 

0 

1 

0 

0.0028 

0.0000 

0.0028 


Disutility (Programs affected) 








Building A 


Physical Property Damage 

Level Description 

Disutility 

E 

NG 

W 

Weight 

3 

Catastrophic physical property damage 

1.00 

0 

0 

0 

0.049 


greater than $10 million 






2 

Major physical property damage 

0.27 

0 

0 

0 



$1 million to $10 million 






1 

Minor physical property damage 

0.03 

1 

1 

1 



less than $1 million 






0 

No phyiscal property damage 

0.00 

0 

0 

0 



Disutility (Physical Property Damage) 


0.0015 

0.0015 

0.0015 

Intellectual Property Damage 


E 

NG 

W 


Level 

Description 

Disutility 




Weight 

3 

Catastrophic intellectual property damage 

1.00 

0 

0 

0 

0.128 


long-term experiments 






2 

Major intellectual property damage 

0.46 

0 

0 

0 



artifacts and rare documents 






1 

Minor intellectual property damage 

0.05 

1 

0 

0 



non-backed up electronic data 






0 

No intellectual property damage 

0.00 

0 

1 

1 



Disutility (Intellectual Property Damage) 


0.0064 

0.0000 

0.0000 

Internal Public Image 


E 

NG 

W 


Level 

Description 

Disutility 




Weight 

3 

Major degree of adverse publicity 

1.00 

0 

0 

0 

0.055 


petitions, sit-ins, demonstrations 






2 

Moderate degree of adverse publicity 

0.34 

0 

0 

0 



negative articles published 






1 

Minor degree of adverse publicity 

0.04 

1 

1 

1 



verbal complaints 






0 

No adverse publicity 

0.00 

0 

0 

0 



Disutility (Internal Public Image) 


0.0022 

0.0022 

0.00221 

External Public Image 


E 

NG 

W 


Level 

Description 

Disutility 




Weight 

3 

Major degree of adverse publicity 

1.00 

0 

0 

0 

0.083 


affects enrollment, contributions, funding, recruiting 





2 

Moderate degree of adverse publicity 

0.57 

0 

0 

0 



national / international media 






1 

Minor degree of adverse publicity 

0.06 

1 

1 

1 



local media 






0 

No adverse publicity 

0.00 

0 

0 

0 



Disutility (External Public Image) 


0.0050 

0.0050 

0.0050 



Performance Index - 

Building A 

|0.0212| 

0.00871 

0.0148| 
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Building B 


Impact on People 


E 

NG 

W 


Level 

Description 

Disutility 




wt 

3 

Fatility or Leathal exposure 

1.00 

0 

0 

0 

0.295 


roof collapse, falling brick, gas inhalation 






2 

Major exposure with long-term effects 

0.46 

0 

0 

0 



lead poisoning 






1 

Minor injury or exposure 

0.05 

0 

0 

0 



broken arm, laceration 






0 

No personal injury 

0.00 

1 

1 

1 



Disutility (Impact on People) 


0.0000 

0.0000 

0.0000 

Impact on the Environmental 


E 

NG 

w 


Level 

Description 

Disutility 




Weight 

3 

Major environmental impact 

LOO 

0 

0 

0 

0.196 








2 

Moderate environmental impact 

0.34 

0 

0 

0 


1 

Minor environmental impact 

0.04 

1 

0 

0 


0 

No environmental impact 

0.00 

0 

1 

1 



Disutility (Impact on the Environment) 


0.0078 

0.0000 

0.0000 

Interruption of Academic Activities and Operations 


E 

NG 

w 


Level 

Description 

Disutility 




Weight 

4 

Extreme interruption 

1.00 

0 

0 

0 

0.056 


greater than 6 months, entire buildings 






3 

Major interruption 

0.57 

0 

0 

0 



1 to 6 months, laboratories 






2 

Moderate interruption 

0.19 

0 

0 

0 



1 to 4 weeks, specialty classrooms 






1 

Minor interruption 

0.06 

1 

0 

1 



less than 1 week, admin units, small class 






0 

No interruption 

0.00 

0 

1 

0 



Disutility (Interruption of Activities & Operations) | 

0.0034 

0.0000 

0.00341 

Programs Affected 


E 

NG 

w 


Level 

Description 

Disutility 




Weight 

4 

Extreme impact 

1.00 

0 

0 

0 

0.138 


> $20M and/or 250 students 






3 

Major impact 

0.50 

0 

0 

0 



$10M to $20M and/or 50 to 250 students 






2 

Moderate impact 

0.23 

0 

0 

0 



$1M to $10M and/or 5 to 50 students 






1 

Minor impact 

0.02 

1 

0 

1 



up to $1M and/or 5 students 






0 

No impact 

0.00 

0 

1 

0 



Disutility (Programs affected) 

[ 

0.0028 

0.0000 

0.0028 







Building B 



Physical Property Damage 

Level Description 

Disutility 

E 

NG 

W 


Weight 

3 

Catastrophic physical property damage 

LOO 

0 

0 

0 


0.049 


greater than $10 million 







2 

Major physical property damage 

0.27 

0 

0 

0 




$1 million to $10 million 







1 

Minor physical property damage 

0.03 

1 

1 

1 




less than $1 million 







0 

No phyiscal property damage 

0.00 

0 

0 

0 




Disutility (Physical Property Damage) 


0.0015 

0.0015 

0.0015 


Intellectual Property Damage 


E 

NG 

W 



Level 

Description 

Disutility 





Weight 

3 

Catastrophic intellectual property damage 

1.00 

0 

0 

0 


0.128 


long-term experiments 







2 

Major intellectual property damage 

0.46 

0 

0 

0 




artifacts and rare documents 







1 

Minor intellectual property damage 

0.05 

1 

1 

1 




non-backed up electronic data 







0 

No intellectual property damage 

0.00 

0 

0 

0 




Disutility (Intellectual Property Damage) 


0.0064 

0.0064 

0.0064 


Internal Public Image 


E 

NG 

W 



Level 

Description 

Disutility 





Weight 

3 

Major degree of adverse publicity 

1.00 

0 

0 

0 


0.055 


petitions, sit-ins, demonstrations 







2 

Moderate degree of adverse publicity 

0.34 

0 

0 

0 




negative articles published 







1 

Minor degree of adverse publicity 

0.04 

1 

1 

1 




verbal complaints 







0 

No adverse publicity 

0.00 

0 

0 

0 




Disutility (Internal Public Image) 


0.0022 

0.0022 

0.0022 


External Public Image 


E 

NG 

W 



Level 

Description 

Disutility 





Weight 

3 

Major degree of adverse publicity 

1.00 

0 

0 

0 


0.083 


affects enrollment, contributions, funding, recruiting 






2 

Moderate degree of adverse publicity 

0.57 

0 

0 

0 




national / international media 







1 

Minor degree of adverse publicity 

0.06 

1 

1 

1 




local media 







0 

No adverse publicity 

0.00 

0 

0 

0 




Disutility (External Public Image) 


0.0050 

0.0050 

0.0050 




Performance Index - 

Building B 

10.0290 

0.01511 

O.O2I2I 


87 






Building C 


Impact on People 


E 

NG 

W 


Level 

Description 

Disutility 




wt 

3 

Fatility or Leathal exposure 

1.00 

0 

0 

0 

0.295 


roof collapse, falling brick, gas inhalation 






2 

Major exposure with long-term effects 

0.46 

0 

0 

0 



lead poisoning 






1 

Minor injury or exposure 

0.05 

1 

0 

0 



broken arm, laceration 






0 

No personal injury 

0.00 

0 

1 

1 



Disutility (Impact on People) 


0.0148 

0.0000 

0.0000 

Impact on 

the Environmental 


E 

NG 

W 


Level 

Description 

Disutility 




Weight 

3 

Major environmental impact 

1.00 

0 

0 

0 

0.196 








2 

Moderate environmental impact 

0.34 

0 

0 

0 


1 

Minor environmental impact 

0.04 

0 

0 

0 


0 

No environmental impact 

0.00 

1 

1 

1 



Disutility (Impact on the Environment) 


0.0000 

0.0000 

0.0000 

Interruption of Academic Activities and Operations 


E 

NG 

w 


Level 

Description 

Disutility 




Weight 

4 

Extreme interruption 

1.00 

0 

0 

0 

0.056 


greater than 6 months, entire buildings 






3 

Major interruption 

0.57 

0 

0 

0 



1 to 6 months, laboratories 






2 

Moderate interruption 

0.19 

0 

0 

0 



1 to 4 weeks, specialty classrooms 






1 

Minor interruption 

0.06 

1 

0 

1 



less than 1 week, admin units, small class 






0 

No interruption 

0.00 

0 

1 

0 



Disutility (Interruption of Activities & Operations) 

0.0034 

0.0000 

0.0034 

Programs Affected 


E 

NG 

W 


Level 

Description 

Disutility 




Weight 

4 

Extreme impact 

LOO 

0 

0 

0 

0.138 


> $20M and/or 250 students 






3 

Major impact 

0.50 

0 

0 

0 



$10M to $20M and/or 50 to 250 students 






2 

Moderate impact 

0.23 

1 

0 

0 



$1M to $I0M and/or 5 to 50 students 






1 

Minor impact 

0.02 

0 

1 

1 



up to $1M and/or 5 students 






0 

No impact 

0.00 

0 

0 

0 



Disutility (Programs affected) 


0.0317 

0.0028 

0.0028 






Building C 

Physical Property Damage E_NG W 




Level 

Description 

Disutility 



• 

Weight 

3 

Catastrophic physical property damage 

1.00 

0 0 

0 


0.049 


greater than $10 million 






2 

Major physical property damage 

0.27 

0 0 

0 




$1 million to $10 million 






1 

Minor physical property damage 

0.03 

1 1 

1 




less than $1 million 






0 

No phyiscal property damage 

0.00 

0 0 

0 




Disutility (Physical Property Damage) 


0.0015 0.0015 

0.0015 


Intellectual Property Damage 


E NG 

W 



Level 

Description 

Disutility 




Weight 

3 

Catastrophic intellectual property damage 

1.00 

0 0 

0 


0.128 


long-term experiments 






2 

Major intellectual property damage 

0.46 

0 0 

0 




artifacts and rare documents 






1 

Minor intellectual property damage 

0.05 

1 0 

0 




non-backed up electronic data 






0 

No intellectual property damage 

0.00 

0 1 

1 




Disutility (Intellectual Property Damage) 


0.0064 0.0000 

0.0000 


Internal Public Image 


E NG 

w 



Level 

Description 

Disutility 




Weight 

3 

Major degree of adverse publicity 

1.00 

0 0 

0 


0.055 


petitions, sit-ins, demonstrations 






2 

Moderate degree of adverse publicity 

0.34 

0 0 

0 




negative articles published 






1 

Minor degree of adverse publicity 

0.04 

1 1 

1 




verbal complaints 






0 

No adverse publicity 

0.00 

0 0 

0 




Disutility (Internal Public Image) 


0.0022 0.0022 

0.0022 


External Public Image 


E NG 

W 



Level 

Description 

Disutility 




Weight 

3 

Major degree of adverse publicity 

1.00 

0 0 

0 


0.083 


affects enrollment, contributions, funding, recruiting 





2 

Moderate degree of adverse publicity 

0.57 

0 0 

0 




national / international media 






1 

Minor degree of adverse publicity 

0.06 

1 1 

0 




local media 




• 


0 

No adverse publicity 

0.00 

0 0 

0 




Disutility (External Public Image) 


0.0050 0.0050 

0.0000 




Performance Index - 

Building C 

o 

o 

CD 

O 

O 

0.00981 
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Building D 
E NG W 


Impact on People 



Level 

Description 

Disutility 

wt 

3 

Fatility or Leathal exposure 

1.00 

0.295 


roof collapse, falling brick, gas inhalation 



2 

Major exposure with long-term effects 
lead poisoning 

0.46 


1 

Minor injury or exposure 
broken arm, laceration 

0.05 


0 

No personal injury 

0.00 



Disutility (Impact on People) 


Impact on 

the Environmental 

Level Description 

Disutility 

Weight 

0.196 

3 

Major environmental impact 

1.00 


2 

Moderate environmental impact 

0.34 


1 

Minor environmental impact 

0.04 


0 

No environmental impact 

0.00 



Disutility (Impact on the Environment) 


Interruption of Academic Activities and Operations 

Level Description 

Disutility 

Weight 

0.056 

4 

Extreme interruption 
greater than 6 months, entire buildings 

1.00 


3 

Major interruption 

1 to 6 months, laboratories 

0.57 


2 

Moderate interruption 

1 to 4 weeks, specialty classrooms 

0.19 


1 

Minor interruption 

less than 1 week, admin units, small class 

0.06 


0 

No interruption 

0.00 



Disutility (Interruption of Activities & Operations) 

Programs Affected 

Level Description 

Disutility 

Weight 

0.138 

4 

Extreme impact 
> $20M and/or 250 students 

1.00 


3 

Major impact 

$10M to $20M and/or 50 to 250 students 

0.50 


2 

Moderate impact 

$1M to $10M and/or 5 to 50 students 

0.23 


1 

Minor impact 

up to $1M and/or 5 students 

0.02 


0 

No impact 

0.00 


0 

0 

0 

0 

0 

0 

1 

0 

0 

0 

1 

1 

0.0148 

0.0000 

0.0000 

E 

NG 

w 

0 

0 

0 

0 

0 

0 

1 

0 

0 

0 

1 

1 

0.0078 

0.0000 

0.0000 

E 

NG 

w 

0 

0 

0 

0 

0 

0 

0 

0 

0 

1 

1 

1 

0 

0 

0 

0.0034 

0.0034 

0.0034 

E 

NG 

w 

0 

0 

0 

0 

0 

0 

1 

0 

0 

0 

1 

1 

0 

0 

0 

0.0317 

0.0028 

0.0028 


Disutility (Programs affected) 




Physical Property Damage 

Level Description 

Disutility 

Weight 

0.049 

3 

Catastrophic physical property damage 
greater than $10 million 

1.00 


2 

Major physical property damage 
$1 million to $10 million 

0.27 


1 

Minor physical property damage 
less than $1 million 

0.03 


0 

No phyiscal property damage 

0.00 


Disutility (Physical Property Damage) 


Intellectual Property Damage 

Level Description 

Disutility 

Weight 

0.128 

3 Catastrophic intellectual property damage 
long-term experiments 

1.00 


2 Major intellectual property damage 
artifacts and rare documents 

0.46 


1 Minor intellectual property damage 
non-backed up electronic data 

0.05 


0 No intellectual property damage 

0.00 


Disutility (Intellectual Property Damage) 


Internal Public Image 

Level Description 

Disutility 

Weight 

0.055 

3 Major degree of adverse publicity 
petitions, sit-ins, demonstrations 

1.00 


2 Moderate degree of adverse publicity 
negative articles published 

0.34 


1 Minor degree of adverse publicity 
verbal complaints 

0.04 


0 No adverse publicity 

0.00 


Disutility (Internal Public Image) 



External Public Image 

Level Description 

Disutility 

Weight 

3 

Major degree of adverse publicity 

1.00 

0.083 


affects enrollment, contributions, funding, recruiting 


2 

Moderate degree of adverse publicity 

0.57 



national / international media 



1 

Minor degree of adverse publicity 

0.06 



local media 



0 

No adverse publicity 

0.00 



Disutility (External Public Image) 



Building D 


E 

NG 

W 

0 

0 

0 

0 

0 

0 

1 

1 

1 

0 

0 

0 

0.0015 

0.0015 

0.0015 

E 

NG 

W 

0 

0 

0 

0 

0 

0 

1 

1 

1 

0 

0 

0 

0.0064 

0.0064 

0.0064 

E 

NG 

W 

0 

0 

0 

0 

0 

0 

1 

1 

1 

0 

0 

0 

0.0022 

0.0022 

0.0022 

E 

NG 

W 

0 

0 

0 

0 

0 

0 

1 

1 

1 

0 

0 

0 

10.0050 

0.0050 

i 0.0050 


10.0727 

0.0212 

0.02121 


Performance Index - Building D 







Building E 
E NG W 


Impact on People 



Level 

Description 

Disutility 

wt 

3 

Fatility or Leathal exposure 

1.00 

0.295 


roof collapse, falling brick, gas inhalation 



2 

Major exposure with long-term effects 
lead poisoning 

0.46 


1 

Minor injury or exposure 
broken arm, laceration 

0.05 


0 

No personal injury 

0.00 



Disutility (Impact on People) 


Impact on 

the Environmental 

Level Description 

Disutility 

Weight 

0.196 

3 

Major environmental impact 

1.00 


2 

Moderate environmental impact 

0.34 


1 

Minor environmental impact 

0.04 


0 

No environmental impact 

0.00 



Disutility (Impact on the Environment) 


Interruption of Academic Activities and Operations 

Level Description 

Disutility 

Weight 

0.056 

4 

Extreme interruption 
greater than 6 months, entire buildings 

1.00 


3 

Major interruption 

1 to 6 months, laboratories 

0.57 


2 

Moderate interruption 

1 to 4 weeks, specialty classrooms 

0.19 


1 

Minor interruption 

less than 1 week, admin units, small class 

0.06 


0 

No interruption 

0.00 



Disutility (Interruption of Activities & Operations) 

Programs Affected 

Level Description 

Disutility 

Weight 

0.138 

4 

Extreme impact 
> $20M and/or 250 students 

1.00 


3 

Major impact 

$10M to $20M and/or 50 to 250 students 

0.50 


2 

Moderate impact 

$1M to $10M and/or 5 to 50 students 

0.23 


1 

Minor impact 

up to $1M and/or 5 students 

0.02 


0 

No impact 

0.00 


0 

0 

0 

0 

0 

0 

1 

0 

1 

0 

1 

0 

0.0148 

0.0000 

0.0148 

E 

NG 

W 

0 

0 

0 

0 

0 

0 

0 

0 

0 

1 

1 

1 

0.0000 

0.0000 

0.0000 

E 

NG 

w 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

1 

1 

1 

0.0000 

0.0000 

0.0000 

E 

NG 

w 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

0 

1 

1 

1 

0.0000 

0.0000 

0.0000 


Disutility (Programs affected) 







Physical Property Damage 

Level Description 

Disutility 

Weight 

0.049 

3 

Catastrophic physical property damage 
greater than $10 million 

1.00 


2 

Major physical property damage 
$1 million to $10 million 

0.27 


1 

Minor physical property damage 
less than $1 million 

0.03 


0 

No phyiscal property damage 

0.00 


Disutility (Physical Property Damage) 


Intellectual Property Damage 

Level Description 

Disutility 

Weight 

0.128 

3 

Catastrophic intellectual property damage 
long-term experiments 

1.00 


2 

Major intellectual property damage 
artifacts and rare documents 

0.46 


1 

Minor intellectual property damage 
non-backed up electronic data 

0.05 


0 

No intellectual property damage 

0.00 


Disutility (Intellectual Property Damage) 


Internal Public Image 

Level Description 

Disutility 

Weight 

0.055 

3 

Major degree of adverse publicity 
petitions, sit-ins, demonstrations 

1.00 


2 

Moderate degree of adverse publicity 
negative articles published 

0.34 


1 

Minor degree of adverse publicity 
verbal complaints 

0.04 


0 

No adverse publicity 

0.00 



Disutility (Internal Public Image) 



External Public Image 

Level Description 

Disutility 

Weight 

3 

Major degree of adverse publicity 

1.00 

0.083 


affects enrollment, contributions, funding, recruiting 


2 

Moderate degree of adverse publicity 

0.57 



national / international media 



1 

Minor degree of adverse publicity 

0.06 



local media 



0 

No adverse publicity 

0.00 



Disutility (External Public Image) 



Building E 


E 

NG 

W 

0 

0 

0 

0 

0 

0 

1 

1 

1 

0 

0 

0 

0.0015 

0.0015 

0.0015 

E 

NG 

W 

0 

0 

0 

0 

0 

0 

1 

0 

0 

0 

1 

1 

0.0064 

0.0000 

0.0000 

E 

NG 

w 

0 

0 

0 

0 

0 

0 

1 

1 

1 

0 

0 

0 

0.0022 

0.0022 

0.0022 

E 

NG 

W 

0 

0 

0 

0 

0 

0 

1 

1 

1 

0 

0 

0 

0.0050 

0.0050 

0.0050 


O 

b 

ro 

CD 

00 

0.0087 

0.02341 


Performance Index - Building E 






Building F 


Impact on People 

Level 

Description 

Disutility 

E 

NG 

w 

wt 

3 

Fatility or Leathal exposure 

1.00 

0 

0 

0 

0.295 


roof collapse, falling brick, gas inhalation 






2 

Major exposure with long-term effects 

0.46 

0 

0 

0 



lead poisoning 






1 

Minor injury or exposure 

0.05 

1 

0 

1 



broken arm, laceration 






0 

No personal injury 

0.00 

0 

1 

0 



Disutility (Impact on People) 


0.0148 

0.0000 

0.0148 

Impact on the Environmental 


E 

NG 

W 


Level 

Description 

Disutility 




Weight 

3 

Major environmental impact 

1.00 

0 

0 

0 

0.196 








2 

Moderate environmental impact 

0.34 

0 

0 

0 


1 

Minor environmental impact 

0.04 

0 

0 

0 


0 

No environmental impact 

0.00 

1 

1 

1 



Disutility (Impact on the Environment) 


0.0000 

0.0000 

0.0000 

Interruption of Academic Activities and Operations 


E 

NG 

w 


Level 

Description 

Disutility 




Weight 

4 

Extreme interruption 

1.00 

0 

0 

0 

0.056 


greater than 6 months, entire buildings 






3 

Major interruption 

0.57 

0 

0 

0 



1 to 6 months, laboratories 






2 

Moderate interruption 

0.19 

0 

0 

0 



1 to 4 weeks, specialty classrooms 






1 

Minor interruption 

0.06 

0 

0 

0 



less than 1 week, admin units, small class 






0 

No interruption 

0.00 

1 

1 

1 



Disutility (Interruption of Activities & Operations) 

0.0000 

0.0000 

0.0000 

Programs Affected 


E 

NG 

w 


Level 

Description 

Disutility 




Weight 

4 

Extreme impact 

1.00 

0 

0 

0 

0.138 


> $20M and/or 250 students 






3 

Major impact 

0.50 

0 

0 

0 



$10M to $20M and/or 50 to 250 students 






2 

Moderate impact 

0.23 

0 

0 

0 



$1M to $10M and/or 5 to 50 students 






1 

Minor impact 

0.02 

0 

0 

0 



up to $1M and/or 5 students 






0 

No impact 

0.00 

1 

1 

1 



Disutility (Programs affected) 


0.0000 

0.0000 

0.0000 




Building F 

Physical Property Damage E _ NG W 


Level Description _ Disutility 


Weight 

3 

Catastrophic physical property damage 

1.00 

0 

0 

0 

0.049 


greater than $10 million 






2 

Major physical property damage 

0.27 

0 

0 

0 



$1 million to $10 million 






1 

Minor physical property damage 

0.03 

1 

1 

1 



less than $1 million 






0 

No phyiscal property damage 

0.00 

0 

0 

0 



Disutility (Physical Property Damage) 


0.0015 

0.0015 

0.0015 

Intellectual Property Damage 


E 

NG 

W 


Level 

Description 

Disutility 




Weight 

3 

Catastrophic intellectual property damage 

1.00 

0 

0 

0 

0.128 


long-term experiments 






2 

Major intellectual property damage 

0.46 

0 

0 

0 



artifacts and rare documents 






1 

Minor intellectual property damage 

0.05 

1 

0 

0 



non-backed up electronic data 






0 

No intellectual property damage 

0.00 

0 

1 

1 



Disutility (Intellectual Property Damage) 


0.0064 

0.0000 

0.0000 

Internal Public Image 


E 

NG 

W 


Level 

Description 

Disutility 




Weight 

3 

Major degree of adverse publicity 

1.00 

0 

0 

0 

0.055 


petitions, sit-ins, demonstrations 






2 

Moderate degree of adverse publicity 

0.34 

0 

0 

0 



negative articles published 






1 

Minor degree of adverse publicity 

0.04 

1 

1 

1 



verbal complaints 






0 

No adverse publicity 

0.00 

0 

0 

0 



Disutility (Internal Public Image) 


0.0022 

0.0022 

0.0022 

External Public Image 


E 

NG 

W 


Level 

Description 

Disutility 




Weight 

3 

Major degree of adverse publicity 

1.00 

0 

0 

0 

0.083 


affects enrollment, contributions, funding, recruiting 





2 

Moderate degree of adverse publicity 

0.57 

0 

0 

0 



national / international media 






1 

Minor degree of adverse publicity 

0.06 

1 

1 

1 



local media 






0 

No adverse publicity 

0.00 

0 

0 

0 



Disutility (External Public Image) 


0.0050 

0.0050 

0.0050 


| 0 . 0298 | 0 . 0087 | 0 . 0234 | 


Performance Index - Building F 



Appendix A.3 Minimal Cut Set Performance Index Rankings 


Performance Index Tally 

E 

G 

W 

Building A 

0.02117 

0.00865 

0.01477 

Building B 

0.02901 

0.01500 

0.02117 

Building C 

0.06490 

0.01141 

0.00979 

Building D 

0.07274 

0.02117 

0.02117 

Building E 

0.02980 

0.00865 

0.02340 

Building F 

0.02980 

0.00865 

0.02340 


MCS 

Building 

A 

E G W 

Building 

B 

E G W 

Building 

C 

E G W 

Building 

D 

E G W 

Building 

E 

E G W 

Building 

F 

E G W 

Performance 

Index 

(PI) 

evl 

ev2 

1 

1 

1 


1 

1 

1 

0.24742 

ev23 

ev6 

1 


1 


1 



0.15881 

evl 

ev6 

1 


1 


1 



0.15881 

ea20 

ev6 

1 


1 


1 



0.15881 

eal9 

ev6 

1 


1 


1 



0.15881 

ev23 

ev5 

1 


1 


1 



0.15881 

evl 

ev5 

1 


1 


1 



0.15881 

ea20 

ev5 

1 


1 


1 



0.15881 

eal9 

ev5 

1 


1 


1 



0.15881 

ev23 

ev4 

1 


1 


1 



0.15881 

evl 

ev4 

1 


1 


1 



0.15881 

ea20 

ev4 

1 


1 


1 



0.15881 

eal9 

ev4 

1 


1 


1 



0.15881 

ev23 

ev2 

1 


1 


1 



0.15881 

ea20 

ev2 

1 


1 


1 



0.15881 

eal9 

ev2 

1 


1 


1 



0.15881 

ev23 

evl 3 

1 


1 


1 



0.15881 

evl 

evl3 

1 


1 


1 



0.15881 

ea20 

evl3 

1 


1 


1 



0.15881 

eal9 

evl3 

1 


1 


1 



0.15881 

ev23 

evlO 

1 


1 


1 



0.15881 

evl 

evlO 

1 


1 


1 



0.15881 

ea20 

evlO 

1 


1 


1 



0.15881 

eal9 

evlO 

1 


1 


1 



0.15881 

ev23 

ea8 

1 


1 


1 



0.15881 

evl 

ea8 

1 


1 


1 



0.15881 

ea20 

ea8 

1 


1 


1 



0.15881 

eal9 

ea8 

1 


1 


1 



0.15881 

ev23 

ea7 

1 


1 


1 



0.15881 

evl 

ea7 

1 


1 


1 



0.15881 

ea20 

ea7 

1 


1 


1 



0.15881 

eal9 

ea7 

1 


1 


1 



0.15881 

ev23 

ea5 

1 


1 


1 



0.15881 

evl 

ea5 

1 


1 


1 



0.15881 


MCS 

Building 

A 

E G W 

Building 

B 

E G W 

Building 

C 

E G W 

Building 

D 

E G W 

Building 

E ‘ 

E G W 

Building 

F 

E G W 

Performance 

Index 

(PI) 

ea20 

ea5 

1 



1 


1 




0.15881 

eal9 

ea5 

1 



1 


1 




0.15881 

ev23 

ea3 

1 



1 


1 




0.15881 

evl 

ea3 

1 



1 


1 




0.15881 

ea20 

ea3 

1 



1 


1 




0.15881 

eal9 

ea3 

1 



1 


1 




0.15881 

ev23 

ea2 

1 



1 


1 




0.15881 

evl 

ea2 

1 



1 


1 




0.15881 

ea20 

ea2 

1 



1 


1 




0.15881 

eal9 

ea2 

1 



1 


1 




0.15881 

ev23 

eal 

1 



1 


1 




0.15881 

evl 

eal 

1 



1 


1 




0.15881 

ea20 

eal 

1 



1 


1 




0.15881 

eal9 

eal 

1 



1 


1 




0.15881 

ev8 







1 

1 1 



0.11508 

wvl5 



1 

1 


1 


1 

1 

1 

0.11370 

wvl4 



1 

1 


1 


1 

1 

1 

0.11370 

wa20 



1 

1 


1 


1 

1 

1 

0.11370 

ev21 

ev6 

1 





1 




0.09391 

ev20 

ev6 

1 





1 




0.09391 

eal7 

ev6 

1 





1 




0.09391 

eal6 

ev6 

1 





1 




0.09391 

ev21 

ev5 

1 





1 




0.09391 

ev20 

ev5 

1 





1 




0.09391 

eal7 

ev5 

1 





1 




0.09391 

eal6 

ev5 

1 





1 




0.09391 

ev21 

ev4 

1 





1 




0.09391 

ev20 

ev4 

1 





1 




0.09391 

eal7 

ev4 

1 





1 




0.09391 

eal6 

ev4 

1 





1 




0.09391 

ev21 

ev2 

1 





1 




0.09391 

ev20 

ev2 

1 





1 




0.09391 

eal7 

ev2 

1 





1 




0.09391 

eal6 

ev2 

1 





1 




0.09391 

ev21 

evl3 

1 





1 




0.09391 

ev20 

evl3 

1 





1 




0.09391 

eal7 

evl3 

1 





1 




0.09391 

eal6 

evl3 

1 





1 




0.09391 

ev21 

evlO 

1 





1 




0.09391 

ev20 

evlO 

1 





1 




0.09391 

eal7 

evlO 

1 





1 




0.09391 

eal6 

evlO 

1 





1 




0.09391 

ev21 

ea8 

1 





1 




0.09391 

ev20 

ea8 

1 





1 




0.09391 

eal7 

ea8 

1 





1 




0.09391 
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Building Building Building Building Building Building Performance 

A B C D E F Index 

MCS EGWEGWEGWEGWEGWEGW (PI) 


eal6 

ea8 

1 



1 



0.09391 

ev21 

ea7 

1 



1 



0.09391 

ev20 

ea7 

1 



1 



0.09391 

eal7 

ea7 

1 



1 



0.09391 

eal6 

ea7 

1 



1 



0.09391 

ev21 

ea5 

1 



1 



0.09391 

ev20 

ea5 

1 



1 



0.09391 

eal7 

ea5 

1 



1 



0.09391 

eal6 

ea5 

1 



1 



0.09391 

ev21 
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1 



1 



0.09391 

ev20 

ea3 

1 



1 



0.09391 

eal7 

ea3 

1 



1 



0.09391 

eal6 

ea3 

1 



1 



0.09391 

ev21 
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1 



1 



0.09391 
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ea2 
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1 
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eal7 
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0.09391 
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0.09391 
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0.09391 

eal7 
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1 



1 
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1 



1 



0.09391 

wvl6 



1 

1 

1 

1 

1 

0.09030 

wal9 



1 

1 

1 

1 

1 

0.09030 

ev24 

ev42 


1 



1 

1 

0.08861 

evl 

ev42 


1 



1 

1 

0.08861 

ea40 

ev42 


1 



1 

1 

0.08861 

ea39 

ev42 


1 



1 

1 

0.08861 

ev24 

ev40 


1 



1 

1 

0.08861 

evl 

ev40 


1 



1 

1 

0.08861 

ea40 

ev40 


1 



1 

1 

0.08861 

ea39 

ev40 


1 



1 

1 

0.08861 

ev24 

ev38 


1 



1 

1 

0.08861 

evl 
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1 

1 
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ea40 
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1 

1 

0.08861 

ea39 
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1 

1 
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1 

1 
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1 

1 
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1 

1 
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ea39 
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1 

1 
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ev24 
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1 

1 
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1 



1 

1 
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1 



1 

1 

0.08861 

ea39 

ev36 


1 



1 

1 

0.08861 

ev24 

ev35 


1 



1 

1 

0.08861 

evl 

ev35 


1 



1 

1 

0.08861 
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# 





MCS 

Building 

A 

E G W 

Building 
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E G W 
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C 
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ea40 

ev35 
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0.02901 

ea39 

ev32 


1 








0.02901 

ev24 

ev30 


1 








0.02901 

evl 

ev30 


1 








0.02901 

ea40 

ev30 


1 








0.02901 

ea39 

ev30 


1 








0.02901 

ev24 

ev3 


1 








0.02901 

evl 

ev3 


1 








0.02901 

ea40 

ev3 


1 








0.02901 

ea39 

ev3 


1 








0.02901 

ev24 

ev29 


1 








0.02901 

evl 

ev29 


1 








0.02901 

ea40 

ev29 


1 








0.02901 

ea39 

ev29 


1 








0.02901 

ev24 

ev27 


1 








0.02901 

evl 

ev27 


1 








0.02901 

ea40 

ev27 


1 








0.02901 

ea39 

ev27 


1 








0.02901 

ev24 

ev26 


1 








0.02901 

evl 

ev26 


1 








0.02901 

ea40 

ev26 


1 








0.02901 

ea39 

ev26 


1 








0.02901 

ev24 

ea37 


1 








0.02901 

evl 

ea37 


1 








0.02901 




MCS 

Building 

A 

E G W 

Building 

B 

E G W 

Building 

C 

E G W 

Building 

D 

E G W 

Building 

E 

E G W 

Building 

F 

E G W 

Performance 

Index 

(PI) 


ea40 

ea37 


1 





0.02901 


ea39 

ea37 


1 





0.02901 


ev24 

ea36 


1 





0.02901 


evl 

ea36 


1 





0.02901 


ea40 

ea36 


1 





0.02901 


ea39 

ea36 


1 





0.02901 


ev24 

ea34 


1 





0.02901 


evl 

ea34 


1 





0.02901 


ea40 

ea34 


1 





0.02901 


ea39 

ea34 


1 





0.02901 


ev24 

ea33 


1 





0.02901 


evl 

ea33 


1 





0.02901 


ea40 

ea33 


1 





0.02901 


ea39 

ea33 


1 





0.02901 


ev24 

ea32 


1 





0.02901 


evl 

ea32 


1 





0.02901 


ea40 

ea32 


1 





0.02901 


ea39 

ea32 


1 





0.02901 


ev24 

ea29 


1 





0.02901 


evl 

ea29 


1 





0.02901 


ea40 

ea29 


1 





0.02901 


ea39 

ea29 


1 





0.02901 


ev25 



1 





0.02901 


ea38 



1 





0.02901 


gv20 



1 

1 




0.02641 


ga5 



1 

1 




0.02641 


wvlO 

wvl7 






1 

0.02340 


wa22 

wvl7 






1 

0.02340 


wal4 

wvl7 






1 

0.02340 


wa22 

wa22 






1 

0.02340 


wvlO 

wal6 






1 

0.02340 


wa22 

wal6 






1 

0.02340 


wal4 

wal6 






1 

0.02340 


wvlO 

wal2 






1 

0.02340 


wal4 

wal2 






1 

0.02340 


wv6 







1 

0.02340 


wv5 






1 


0.02340 


wvl3 






1 


0.02340 


wvl2 







1 

0.02340 


wal7 






1 


0.02340 


wal5 







1 

0.02340 


walO 






1 


0.02340 


ev21 

ev8 

1 






0.02117 


ev20 

ev8 

1 






0.02117 


eal7 

ev8 

1 






0.02117 
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MCS 


Building Building Building Building Building Building Performance 

A B C D E F Index 

E G W E G W E G W E G W E G W E G W (PI) 


eal6 

ev8 

1 




0.02117 

ev21 

evl7 

1 




0.02117 

ev20 

evl7 

1 




0.02117 

eal7 

evl7 

1 




0.02117 

eal6 

evl7 

1 




0.02117 

ev21 

evl5 

1 




0.02117 

ev20 

evl5 

1 




0.02117 

eal7 

evl5 

1 




0.02117 

eal6 

evl5 

1 




0.02117 

ev21 

evl4 

1 




0.02117 

ev20 

evl4 

1 




0.02117 

eal7 

evl4 

1 




0.02117 

eal6 

evl4 

1 




0.02117 

ev21 

ea9 

1 




0.02117 

ev20 

ea9 

1 




0.02117 

eal7 

ea9 

1 




0.02117 

eal6 

ea9 

1 




0.02117 

ev21 

eal4 

1 




0.02117 

ev20 

eal4 

1 




0.02117 

eal7 

eal4 

1 




0.02117 

eal6 

eal4 

1 




0.02117 

ev21 

eal3 

1 




0.02117 

ev20 

eal3 

1 




0.02117 

eal7 

eal3 

1 




0.02117 

eal6 

eal3 

1 




0.02117 

ev21 

eal2 

1 




0.02117 

ev20 

eal2 

1 




0.02117 

eal7 

eal2 

1 




0.02117 

eal6 

eal2 

1 




0.02117 

wv8 



1 



0.02117 

wv4 





1 

0.02117 

wv2 



1 



0.02117 

wvll 





1 

0.02117 

wa9 





1 

0.02117 

wa4 



1 



0.02117 

wa3 



1 



0.02117 

wa21 





1 

0.02117 

wal8 



1 



0.02117 

wal3 





1 

0.02117 

gv4 




1 


0.02117 

gvlO 




1 


0.02117 

ga9 




1 


0.02117 

ga21 




1 


0.02117 

galO 




1 


0.02117 

evl9 


1 




0.02117 
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MCS 


Building 

A 

E G W 


Building 

B 

E G W 


Building 

C 

E G W 


Building 

D 

E G W 


Building Building Performance 
E F Index 

E G W E G W (PI) 


evl8 


eal5 


gv8 


gv2 


ga4 


ga3 


wv9 


wvl 


wa2 


wal 


gv7 


gv3 


ga7 


ga6 


wv7 


wv3 


wa7 


wa6 


gvl2 

gvl7 

gal6 

gvl7 

gal5 

gvl7 

gvl2 

gvll 

gal 6 

gvll 

gal 5 

gvll 

gvl2 

ga22 

gal 6 

ga22 

gvl2 

gal4 

gal6 

gal4 

gal 5 

gal4 

gvl2 

gal 3 

gal 6 

gal3 

gal 5 

gal 3 

gvl2 

ev3 

gal 6 

ev3 

gal5 

ev3 

gv9 


gv6 


gv5 


gvl3 


gvl 


ga2 


gal 8 


gal7 


gal 



1 

1 

1 

1 

1 

1 

1 

1 

1 

1 

1 

1 

1 

1 

1 

1 

1 


1 

1 

1 


1 

1 


0.02117 

0.02117 

0.01500 

0.01500 

0.01500 

0.01500 

0.01477 

0.01477 

0.01477 

0.01477 

0.01141 

0.01141 

0.01141 

0.01141 

0.00979 

0.00979 

0.00979 

0.00979 

0.00865 

0.00865 

0.00865 

0.00865 

0.00865 

0.00865 

0.00865 

0.00865 

0.00865 

0.00865 

0.00865 

0.00865 

0.00865 

0.00865 

0.00865 

0.00865 

0.00865 

0.00865 

0.00865 

0.00865 

0.00865 

0.00865 

0.00865 

0.00865 

0.00865 

0.00865 


Appendix A.4 Vulnerability Classifications 


MCS 

Susceptibility 

MCS 

Susceptibility 

ev8 

High 

ea38 

Very Low 

evil 

High 

gal 

Very Low 

ev21 

High 

galO 

Very Low 

ev22 

High 

gal7 

Very Low 

ev3 

High 

gal8 

Very Low 

ev34 

High 

ga2 

Very Low 

ev9 

High 

ga21 

Very Low 

evl8 

High 

ga3 

Very Low 

evl9 

High 

ga4 

Very Low 

ev25 

High 

ga5 

Very Low 

gvl 

Moderate 

ga6 

Very Low 

gv2 

Moderate 

ga7 

Very Low 

gv3 

Moderate 

ga8 

Very Low 

gv4 

Moderate 

ga9 

Very Low 

gv5 

Moderate 

gvlO 

Very Low 

gv6 

Moderate 

gvl3 

Very Low 

wvl 

Moderate 

gvl9 

Very Low 

wv2 

Moderate 

gv20 

Very Low 

wv3 

Moderate 

gv7 

Very Low 

wv4 

Moderate 

gv8 

Very Low 

wv5 

Moderate 

gv9 

Very Low 

wv6 

Moderate 

wal 

Very Low 

ealO 

Very Low 

walO 

Very Low 

eal8 

Very Low 

wal3 

Very Low 

ea30 

Very Low 

wal5 

Very Low 

gall 

Very Low 

wal 7 

Very Low 

gal9 

Very Low 

wal 8 

Very Low 

ga20 

Very Low 

wa2 

Very Low 

gvl4 

Very Low 

wa21 

Very Low 

gvl5 

Very Low 

wa3 

Very Low 

gvl6 

Very Low 

wa4 

Very Low 

gvl7 

Very Low 

wa5 

Very Low 

gvl 8 

Very Low 

wa6 

Very Low 

wall 

Very Low 

wa7 

Very Low 

wa8 

Very Low 

wa9 

Very Low 

wvl 8 

Very Low 

wvll 

Very Low 

wvl9 

Very Low 

wvl2 

Very Low 

wal9 

Very Low 

wvl3 

Very Low 

wvl6 

Very Low 

wv20 

Very Low 

eal5 

Very Low 

wv7 

Very Low 

wa20 

Very Low 

wv8 

Very Low 

wvl4 

Very Low 

wv9 

Very Low 

wvl5 

Very Low 






Appendix A.5 Vulnerability Classifications 


Performance 

Index 


MCS 

(PI) 

Value 

Susceptibility 

Vulnerability 

ev8 

0.11508 

Exterme 

High 

Red 

ev21 

0.06490 

Low 

High 

Yellow 

ev22 

0.06490 

Low 

High 

Yellow 

ev3 

0.05960 

Low 

High 

Yellow 

ev34 

0.05960 

Low 

High 

Yellow 

ev9 

0.07274 

Low 

High 

Yellow 

evil 

0.05018 

Very Low 

High 

Blue 

evl8 

0.02117 

Very Low 

High 

Blue 

evl9 

0.02117 

Veiy Low 

High 

Blue 

ev25 

0.02901 

Very Low 

High 

Blue 

gvl 

0.00865 

Very Low 

Moderate 

Blue 

gv2 

0.01505 

Very Low 

Moderate 

Blue 

gv3 

0.01141 

Very Low 

Moderate 

Blue 

gv4 

0.02117 

Very Low 

Moderate 

Blue 

gv5 

0.00865 

Very Low 

Moderate 

Blue 

gv6 

0.00865 

Very Low 

Moderate 

Blue 

wvl 

0.01477 

Very Low 

Moderate 

Blue 

wv2 

0.02117 

Very Low 

Moderate 

Blue 

wv3 

0.00979 

Very Low 

Moderate 

Blue 

wv4 

0.02117 

Very Low 

Moderate 

Blue 

wv5 

0.02340 

Very Low 

Moderate 

Blue 

wv6 

0.02340 

Very Low 

Moderate 

Blue 

wa20 

0.11370 

Exterme 

Very Low 

Blue 

wvl4 

0.11370 

Exterme 

Very Low 

Blue 

wvl5 

0.11370 

Exterme 

Very Low 

Blue 

ealO 

0.07274 

Low 

Very Low 

Green 

eal8 

0.06490 

Low 

Very Low 

Green 

ea30 

0.05960 

Low 

Very Low 

Green 

gall 

0.05628 

Low 

Very Low 

Green 

gal 9 

0.06493 

Low 

Very Low 

Green 

ga20 

0.07358 

Low 

Very Low 

Green 

gvl4 

0.07358 

Low 

Very Low 

Green 

gvl 5 

0.07358 

Low 

Very Low 

Green 

gvl6 

0.06493 

Low 

Very Low 

Green 

gvl7 

0.05628 

Low 

Very Low 

Green 

gvl 8 

0.05628 

Low 

Very Low 

Green 

wal 1 

0.06913 

Low 

Very Low 

Green 

wvl8 

0.06913 

Low 

Very Low 

Green 

wal 9 

0.09030 

Moderate 

Very Low 

Green 

wvl6 

0.09030 

Moderate 

Very Low 

Green 

eal5 

0.02117 

Very Low 

Very Low 

Green 

ea38 

0.02901 

Very Low 

Very Low 

Green 
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Performance 

Index 


MCS 

(PI) 

Value 

Susceptibility 

Vulnerabili 

gal 

0.00865 

Very Low 

Very Low 

Green 

galO 

0.02117 

Very Low 

Very Low 

Green 

gal7 

0.00865 

Very Low 

Very Low 

Green 

gal8 

0.00865 

Very Low 

Very Low 

Green 

ga2 

0.00865 

Very Low 

Very Low 

Green 

ga21 

0.02117 

Very Low 

Very Low 

Green 

ga3 

0.01505 

Very Low 

Very Low 

Green 

ga4 

0.01505 

Very Low 

Very Low 

Green 

ga5 

0.26460 

Very Low 

Very Low 

Green 

ga6 

0.01141 

Very Low 

Very Low 

Green 

ga7 

0.01141 

Very Low 

Very Low 

Green 

ga8 

0.03511 

Very Low 

Very Low 

Green 

ga9 

0.02117 

Very Low 

Very Low 

Green 

gvlO 

0.02117 

Very Low 

Very Low 

Green 

gvl3 

0.00865 

Very Low 

Very Low 

Green 

gvl9 

0.03511 

Very Low 

Very Low 

Green 

gv20 

0.26460 

Very Low 

Very Low 

Green 

gv7 

0.01141 

Very Low 

Very Low 

Green 

gv8 

0.01505 

Very Low 

Very Low 

Green 

gv9 

0.00865 

Very Low 

Very Low 

Green 

wal 

0.01477 

Very Low 

Very Low 

Green 

walO 

0.02340 

Very Low 

Very Low 

Green 

wal 3 

0.02117 

Very Low 

Very Low 

Green 

wal5 

0.02340 

Very Low 

Very Low 

Green 

wal 7 

0.02340 

Very Low 

Very Low 

Green 

wal 8 

0.02117 

Very Low 

Very Low 

Green 

wa2 

0.01477 

Very Low 

Very Low 

Green 

wa21 

0.02117 

Very Low 

Very Low 

Green 

wa3 

0.02117 

Very Low 

Very Low 

Green 

wa4 

0.02117 

Very Low 

Very Low 

Green 

wa5 

0.03096 

Very Low 

Very Low 

Green 

wa6 

0.00979 

Very Low 

Very Low 

Green 

wa7 

0.00979 

Very Low 

Very Low 

Green 

wa8 

0.04573 

Very Low 

Very Low 

Green 

wa9 

0.02117 

Very Low 

Very Low 

Green 

wvll 

0.02117 

Very Low 

Very Low 

Green 

wvl2 

0.02340 

Very Low 

Very Low 

Green 

wvl3 

0.02340 

Very Low 

Very Low 

Green 

wvl9 

0.04573 

Very Low 

Very Low 

Green 

wv20 

0.03096 

Very Low 

Very Low 

Green 

wv7 

0.00979 

Very Low 

Very Low 

Green 

wv8 

0.02117 

Very Low 

Very Low 

Green 

wv9 

0.01477 

Very Low 

Very Low 

Green 
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